PT-2023-9347 · Gnu+7 · Gnu Libmicrohttpd+7
Dejan Alvadzijevic
+1
·
Published
2023-02-28
·
Updated
2025-01-20
·
CVE-2023-27371
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
GNU libmicrohttpd versions prior to 0.9.76
Description
The issue is related to the improper parsing of a multipart/form-data boundary in the MHD create post processor() method. This can be exploited by an attacker to send a malicious HTTP POST packet, potentially resulting in an out-of-bounds read and a crash in the find boundary() function. The exploitation of this issue may allow a remote attacker to cause a denial of service.
Recommendations
For GNU libmicrohttpd versions prior to 0.9.76, update to version 0.9.76 or later to resolve the issue. As a temporary workaround, consider restricting access to the postprocessor.c module or disabling the MHD create post processor() function until a patch is available. Avoid using the
boundary field in multipart/form-data requests until the issue is resolved.Exploit
Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Gnu Libmicrohttpd
Red Hat
Red Os
Suse