PT-2023-9377 · Zabbix+4 · Zabbix+4

Maris Melnikovs + 1 · Published 2023-06-16 · Updated 2024-10-03 · CVE-2023-29458

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Zabbix versions (affected versions not specified) Duktape version 2.6

Description The issue is related to an unverified array indexing in the Duktape component of the Zabbix monitoring system. This can lead to a denial of service when exploited by a remote attacker. The problem occurs due to a bug in Duktape 2.6, which is a third-party embeddable JavaScript engine used for its portability and compact footprint. When too many values are added to the valstack in JavaScript, it will crash.

Recommendations For Duktape version 2.6, consider disabling the use of the valstack in JavaScript until a patch is available. As a temporary workaround, restrict the number of values that can be added to the valstack to prevent JavaScript from crashing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

ALT-PU-2023-5065

ALT-PU-2023-6268

BDU:2024-06937

CVE-2023-29458

DLA-3909-1

Affected Products

Alt Linux

Astra Linux

Debian

Duktape

Zabbix

References · 93

• https://bdu.fstec.ru/vul/2023-01720 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22119 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29458 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23133 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35230 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00033 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29458 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24917 · Security Note
• https://bdu.fstec.ru/vul/2023-01712 · Security Note
• https://bdu.fstec.ru/vul/2024-04280 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=319139257 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-6268 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32727 · Security Note
• https://bdu.fstec.ru/vul/2024-07007 · Security Note