Описание
A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.
Отчет
A NULL pointer dereference flaw of moderate severity was found in libsoup's SoupAuthDigest HTTP Digest authentication handling, affecting libsoup as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When a libsoup-based client uses Digest authentication and receives an Unauthorized response in which a malicious or compromised HTTP server omits the required "nonce" parameter, the client crashes. This is a client-side denial of service only; confidentiality and integrity are not affected, and exploitation requires the user to connect to an attacker-controlled server. Red Hat's severity rating (MODERATE, CVSS 6.5) matches the upstream assessment. The fix has been deferred for libsoup in Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat In-Vehicle OS 1, where the residual risk is limited to a crash of the affected client application when it connects to a malicious server; a fix is being pursued for libsoup3 in Red Hat Enterprise Linux 10 and for libsoup in Fedora through the community process. The legacy libsoup component in Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support is out of support scope, and the mingw-libsoup component in Red Hat Build of RHEL 8 will not be fixed.
Меры по смягчению последствий
Currently, no mitigation is available for this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libsoup | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libsoup | Out of support scope | ||
| Red Hat Enterprise Linux 8 | libsoup | Fix deferred | ||
| Red Hat Enterprise Linux 9 | libsoup | Fix deferred | ||
| Red Hat Enterprise Linux 10 | libsoup3 | Fixed | RHSA-2025:7505 | 13.05.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.
A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.
Libsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with digest authentication
A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a N ...
A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.
EPSS
6.5 Medium
CVSS3