CVE-2019-3833
High
Description
Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Openwsman
PublishedMar 14, 2019
First seenMar 14, 2019
Weakness typeCWE-835CWE-835
How to fix
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V5HJ355RSKMFQ7GRJAHRZNDVXASF7TA/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2HEZ7D7GF3HDF36JLGYXIK5URR66DS4/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CXQP7UDPRZIZ4LM7FEJCTC2EDUYVOR2J/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openwsman_project openwsman | v ≤ 2.6.9 | — |
| fedoraproject fedora | 28, 29, 30 | — |
| opensuse leap | 15.0, 42.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.