PT-2023-23002 · H2O · H2O

Elijahglover · Published 2023-04-27 · Updated 2023-05-09 · CVE-2023-30847

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions H2O versions 2.3.0-beta2 and prior

Description H2O is an HTTP server. When the reverse proxy handler tries to process a certain type of invalid HTTP request, it tries to build an upstream URL by reading from an uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers.

Recommendations For H2O versions 2.3.0-beta2 and prior, users should upgrade to commit f010336 or later to fix the issue.

Exploit

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

CVE-2023-30847

GHSA-P5HJ-PHWJ-HRVX

Affected Products

H2O

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30847.json · Exploit
• https://github.com/h2o/h2o/commit/f010336bab162839df43d9e87570897466c97e33 · Patch
• https://github.com/h2o/h2o/pull/3229 · Vendor Advisory
• https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30847 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-30847 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-30847 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-30847 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-30847 · Vendor Advisory
• https://t.me/pentestingnews/35474 · Telegram Post
• https://t.me/cibsecurity/62977 · Telegram Post