PT-2023-7068 · Memcached+5 · Memcached+5

Dormando · Publicado 2023-10-27 · Atualizado 2026-03-29 · CVE-2023-46853

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Memcached versions prior to 1.6.22

Description The issue is related to an off-by-one error when processing proxy requests in proxy mode, specifically if is used instead of r . This error can be exploited by a remote attacker to execute arbitrary code using a specially crafted HTTP request.

Recommendations For versions prior to 1.6.22, update to version 1.6.22 or later to resolve the issue. As a temporary workaround, consider restricting the use of proxy mode or ensuring that only r is used instead of for line endings in proxy requests.

Correção

Enumeração de Fraquezas

CWE-193

Identificadores relacionados

ALT-PU-2023-7120

ALT-PU-2023-7210

AZL-31732

AZL-34977

BDU:2023-08093

BIT-MEMCACHED-2023-46853

CVE-2023-46853

OPENSUSE-SU-2024:13427-1

USN-6476-1

Produtos afetados

Alt Linux

Debian

Linuxmint

Memcached

Red Os

Ubuntu

Referências · 31

• https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624d790fa · Correção
• https://github.com/memcached/memcached/compare/1.6.21...1.6.22 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-memcached-cve-2021-37519-cve-2023-46853-cve-2023-46852 · Nota
• https://cybersecurity-help.cz/vdb/SB2023111329 · Nota
• https://safe-surf.ru/specialists/bulletins-nkcki/701082 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:13427-1 · Aviso do Fabricante
• https://altsp.su/obnovleniya-bezopasnosti · Nota
• https://ubuntu.com/security/notices/USN-6476-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-46852 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6476-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46853 · Aviso do Fabricante
• https://safe-surf.ru/upload/VULN-new/VULN.2023-11-17.1.pdf · Nota de Segurança
• https://cve.basealt.ru/report-10112023-c10f1.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-46853 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-46853 · Nota de Segurança