PT-2023-20329 · Apache · Apache Httpd

Félix Arreola Rodríguez · Publicado 2023-02-23 · Atualizado 2023-05-16 · CVE-2023-25824

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mod gnutls versions 0.9.0 through 0.12.0

Description Mod gnutls is a TLS module for Apache HTTPD based on GnuTLS. It did not properly fail blocking read operations on TLS connections when the transport hit timeouts, entering an endless loop and consuming CPU resources. This could be exploited for denial of service attacks. If trace level logging was enabled, it would also produce an excessive amount of log output during the loop, consuming disk space.

Recommendations Update to version 0.12.1 to fix the issue. For users who cannot update, apply the errno fix detailed in the security advisory.

Exploit

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2023-25824

GHSA-6CFV-FVGM-7PC8

Produtos afetados

Apache Httpd

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25824.json · Exploit
• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942737#25 · Exploit
• https://github.com/airtower-luna/mod_gnutls/security/advisories/GHSA-6cfv-fvgm-7pc8 · Aviso do Fabricante
• https://github.com/airtower-luna/mod_gnutls/commit/d7eec4e598158ab6a98bf505354e84352f9715ec · Correção
• https://t.me/cvenotify/50604 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2023-25824 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25824 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25824 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-25824 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-25824 · Aviso do Fabricante
• https://t.me/cibsecurity/58833 · Publicação no Telegram