PT-2019-1633 · Openwsman+5 · Openwsman+5
Adam Mariš
·
Publicado
2019-03-12
·
Atualizado
2023-02-12
·
CVE-2019-3833
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Openwsman versions up to and including 2.6.9
Description
The issue is related to an infinite loop in the
process connection() function when parsing specially crafted HTTP requests, such as /api/v1/login. A remote, unauthenticated attacker can exploit this by sending a malicious HTTP request to cause a denial of service to the openwsman server. The vulnerability is also associated with resource management errors.Recommendations
For Openwsman versions up to and including 2.6.9, consider disabling the
process connection() function as a temporary workaround until a patch is available. Restrict access to the openwsman server to minimize the risk of exploitation. Avoid using the openwsman server until the issue is resolved.Correção
DoS
Infinite Loop
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Almalinux
Centos
Openwsman
Red Hat
Rocky Linux
Suse