PT-2023-27609 · Veilid · Veilid

Published 2023-08-20 · Updated 2023-08-25 · CVE-2023-40711

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Veilid versions prior to 0.1.9

Description The issue allows remote attackers to cause a denial of service (out-of-memory abort) via crafted packet data. This is due to the lack of size checking for uncompressed data during decompression upon an envelope receipt. The issue has been exploited in the wild in August 2023.

Recommendations For versions prior to 0.1.9, update to version 0.1.9 or later to resolve the issue. As a temporary workaround, consider restricting the receipt of envelope data to trusted sources until a patch is applied.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-40711

Affected Products

Veilid

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-40711 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40711 · Vendor Advisory
• https://gitlab.com/veilid/veilid/-/blob/main/CHANGELOG.md · Note
• https://t.me/cibsecurity/68861 · Telegram Post