PT-2021-17024 · Cesanta · Cesanta Mongoose Https Server

Published 2021-02-08 · Updated 2021-02-12 · CVE-2021-26529

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose HTTPS server versions 6.7 through 7.0

Description The mg tls init function in the Cesanta Mongoose HTTPS server is vulnerable to a remote out-of-bounds (OOB) write attack via a connection request after exhausting the memory pool. This issue affects servers compiled with mbedTLS support.

Recommendations For versions 6.7 through 7.0, consider disabling the mg tls init function as a temporary workaround until a patch is available. Restrict access to the affected server to minimize the risk of exploitation. Avoid using the affected server for critical operations until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-26529

Affected Products

Cesanta Mongoose Https Server

References · 7

• 🔥 https://github.com/cesanta/mongoose/issues/1203 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-26529 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26529 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26529 · Vendor Advisory
• https://t.me/cibsecurity/23273 · Telegram Post
• https://t.me/cvenotify/9624 · Telegram Post