PT-2023-29593 · Jetbrains · Jetbrains Ktor

Published 2023-10-09 · Updated 2023-10-12 · CVE-2023-45613

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions JetBrains Ktor versions prior to 2.3.5

Description The issue concerns the verification of server certificates. In affected versions, server certificates were not verified.

Recommendations For versions prior to 2.3.5, update to version 2.3.5 or later to resolve the issue. As a temporary workaround, consider disabling the use of unverified server certificates until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2023-45613

Affected Products

Jetbrains Ktor

References · 7

• https://osv.dev/vulnerability/CVE-2023-45613 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45613 · Security Note
• https://t.me/cibsecurity/71820 · Telegram Post
• https://twitter.com/CVEnew/status/1711330668636991627 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45613 · Note
• https://twitter.com/VulmonFeeds/status/1711358111422763342 · Twitter Post