PT-2023-23002 · H2O · H2O

Elijahglover · Publicado 2023-04-27 · Atualizado 2023-05-09 · CVE-2023-30847

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions H2O versions 2.3.0-beta2 and prior

Description H2O is an HTTP server. When the reverse proxy handler tries to process a certain type of invalid HTTP request, it tries to build an upstream URL by reading from an uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers.

Recommendations For H2O versions 2.3.0-beta2 and prior, users should upgrade to commit f010336 or later to fix the issue.

Exploit

Correção

Access of Uninitialized Pointer

Enumeração de Fraquezas

CWE-824

Identificadores relacionados

CVE-2023-30847

GHSA-P5HJ-PHWJ-HRVX

Produtos afetados

H2O

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30847.json · Exploit
• https://github.com/h2o/h2o/commit/f010336bab162839df43d9e87570897466c97e33 · Correção
• https://github.com/h2o/h2o/pull/3229 · Aviso do Fabricante
• https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-30847 · Aviso do Fabricante
• https://t.me/pentestingnews/35474 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2023-30847 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-30847 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-30847 · Aviso do Fabricante
• https://t.me/cibsecurity/62977 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2023-30847 · Aviso do Fabricante