PT-2023-24726 · Mongoose · Mongoose

Ben Kallus + 1 · Publicado 2023-06-23 · Atualizado 2025-02-28 · CVE-2023-34188

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.10

Description The issue arises from the HTTP server in Mongoose accepting requests with negative Content-Length headers. This can be exploited by an attacker sending a single malicious payload over TCP, causing the server to enter an infinite loop where it continuously reparses the payload and fails to respond to other requests.

Recommendations For versions prior to 7.10, update to version 7.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP server to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-1284

Identificadores relacionados

CVE-2023-34188

Produtos afetados

Mongoose

Referências · 12

• https://github.com/cesanta/mongoose/compare/7.9...7.10 · Nota
• https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f · Correção
• https://github.com/cesanta/mongoose/pull/2197 · Correção
• https://security.netapp.com/advisory/ntap-20250228-0001 · Nota
• https://t.me/cvenotify/52978 · Publicação no Telegram
• https://t.me/cvenotify/57636 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-34188 · Aviso do Fabricante
• https://t.me/cvenotify/112772 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2023-34188 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-34188 · Aviso do Fabricante
• https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-34188 · Nota de Segurança