PT-2024-15266 · Secure Systems Engineering · Secure Systems Engineering Connaisseur

Starkteetje · Published 2024-09-02 · Updated 2024-11-01 · CVE-2023-7279

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Secure Systems Engineering Connaisseur versions up to 3.3.0

Description A vulnerability has been found in Secure Systems Engineering Connaisseur, affecting unknown code of the file connaisseur/res/targets schema.json of the component Delegation Name Handler. The manipulation leads to inefficient regular expression complexity. The complexity of an attack is rather high, and the exploitation appears to be difficult.

Recommendations To address this issue, upgrade to version 3.3.1. As a temporary workaround, consider restricting access to the vulnerable component Delegation Name Handler until a patch is applied. Ensure the affected component is upgraded to mitigate the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2023-7279

Affected Products

Secure Systems Engineering Connaisseur

References · 24

• https://github.com/sse-secure-systems/connaisseur/releases/tag/v3.3.1 · Patch
• https://github.com/sse-secure-systems/connaisseur/commit/524b73ff7306707f6d3a4d1e86401479bca91b02 · Patch
• https://github.com/sse-secure-systems/connaisseur/pull/1407 · Patch
• https://osv.dev/vulnerability/CVE-2023-7279 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7279 · Security Note
• https://twitter.com/transilienceai/status/1831794256652198392 · Twitter Post
• https://twitter.com/transilienceai/status/1831794171327476055 · Twitter Post
• https://twitter.com/CVEnew/status/1830614632874271000 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1830716767758393386 · Twitter Post
• https://t.me/cvedetector/4656 · Telegram Post
• https://vuldb.com/?ctiid.276268 · Note
• https://twitter.com/transilienceai/status/1831794200066564387 · Twitter Post
• https://twitter.com/transilienceai/status/1831794195004322015 · Twitter Post
• https://twitter.com/transilienceai/status/1831794182685692012 · Twitter Post
• https://twitter.com/transilienceai/status/1831794165954572528 · Twitter Post