PT-2023-20329 · Apache · Apache Httpd

Félix Arreola Rodríguez · Published 2023-02-23 · Updated 2023-05-16 · CVE-2023-25824

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mod gnutls versions 0.9.0 through 0.12.0

Description Mod gnutls is a TLS module for Apache HTTPD based on GnuTLS. It did not properly fail blocking read operations on TLS connections when the transport hit timeouts, entering an endless loop and consuming CPU resources. This could be exploited for denial of service attacks. If trace level logging was enabled, it would also produce an excessive amount of log output during the loop, consuming disk space.

Recommendations Update to version 0.12.1 to fix the issue. For users who cannot update, apply the errno fix detailed in the security advisory.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2023-25824

GHSA-6CFV-FVGM-7PC8

Affected Products

Apache Httpd

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25824.json · Exploit
• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942737#25 · Exploit
• https://github.com/airtower-luna/mod_gnutls/security/advisories/GHSA-6cfv-fvgm-7pc8 · Vendor Advisory
• https://github.com/airtower-luna/mod_gnutls/commit/d7eec4e598158ab6a98bf505354e84352f9715ec · Patch
• https://cve.org/CVERecord?id=CVE-2023-25824 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25824 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-25824 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-25824 · Vendor Advisory
• https://t.me/cvenotify/50604 · Telegram Post
• https://t.me/cibsecurity/58833 · Telegram Post