PT-2024-12837 · Progress · Progress Application Server (Pas) For Openedge

Published 2024-01-18 · Updated 2024-01-26 · CVE-2023-40052

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Progress Application Server (PAS) for OpenEdge versions 11.7 prior to 11.7.18 Progress Application Server (PAS) for OpenEdge versions 12.2 prior to 12.2.13 Progress Application Server (PAS) for OpenEdge innovation releases prior to 12.8.0

Description This issue allows an attacker to cause the crash of a PASOE agent by producing a malformed web request, potentially disrupting the thread activities of many web application clients. Multiple attacks could lead to the flooding of invalid requests, overwhelming the server's ability to process valid requests.

Recommendations For versions 11.7 prior to 11.7.18, update to version 11.7.18 or later. For versions 12.2 prior to 12.2.13, update to version 12.2.13 or later. For innovation releases prior to 12.8.0, update to version 12.8.0 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2023-40052

Affected Products

Progress Application Server (Pas) For Openedge

References · 7

• https://community.progress.com/s/article/Important-Progress-OpenEdge-Product-Alert-for-Progress-Application-Server-for-OpenEdge-PASOE-Denial-of-Service-Vulnerability-in-WEB-Transport · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40052 · Security Note
• https://progress.com/openedge · Note
• https://t.me/cvenotify/68840 · Telegram Post
• https://twitter.com/CVEnew/status/1748004569752220020 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1748034714567372806 · Twitter Post