CVE-2023-37279
High
Description
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.
SeverityHigh
CVSS7.5
Exploit probability60. percentile0.9%
ProductContribsys Faktory
PublishedSep 20, 2023
First seenSep 20, 2023
How to fix
Update
- contribsys faktory1.8.0 or later
- github.com/contribsys/faktory1.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| contribsys faktory | v < 1.8.0 | 1.8.0 |
| github.com/contribsys/faktoryGo | v < 1.8.0 | 1.8.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.