CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0809 – mosquitto: memory leak leads to unresponsive broker
https://notcve.org/view.php?id=CVE-2023-0809
In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets. En Mosquitto anterior a 2.0.16, el exceso de memoria se asigna en función de paquetes iniciales maliciosos que no son paquetes CONNECT. A memory leak vulnerability was found in Eclipse Mosquitto. This issue is triggered by malicious initial packets or certain client actions and may allow a remote attacker to the deplete system resources causing memory exhaustion, leading to a disruption in services and a denial of service condition. • https://mosquitto.org/blog/2023/08/version-2-0-16-released https://security.gentoo.org/glsa/202401-09 https://access.redhat.com/security/cve/CVE-2023-0809 https://bugzilla.redhat.com/show_bug.cgi?id=2236882 • CWE-401: Missing Release of Memory after Effective Lifetime CWE-770: Allocation of Resources Without Limits or Throttling CWE-789: Memory Allocation with Excessive Size Value •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3592 – mosquitto: memory leak leads to unresponsive broker
https://notcve.org/view.php?id=CVE-2023-3592
In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types. En Mosquitto anterior a 2.0.16, se produce una pérdida de memoria cuando los clientes envían paquetes CONNECT v5 con un mensaje de voluntad que contiene tipos de propiedades no válidos. A memory leak vulnerability was found in Eclipse Mosquitto. This issue is triggered by malicious initial packets or certain client actions and may allow a remote attacker to the deplete system resources causing memory exhaustion, leading to a disruption in services and a denial of service condition. • https://mosquitto.org/blog/2023/08/version-2-0-16-released https://security.gentoo.org/glsa/202401-09 https://access.redhat.com/security/cve/CVE-2023-3592 https://bugzilla.redhat.com/show_bug.cgi?id=2236882 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-4760 – Remote Code Execution in Eclipse RAP on Windows
https://notcve.org/view.php?id=CVE-2023-4760
In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept. For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed. En las versiones de Eclipse RAP desde 3.0.0 hasta 3.25.0 incluida, la Ejecución Remota de Código es posible en Windows cuando se utiliza el componente FileUpload. • https://github.com/eclipse-rap/org.eclipse.rap/pull/141 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/160 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 1CVE-2023-41900 – Jetty's OpenId Revoked authentication allows one request
https://notcve.org/view.php?id=CVE-2023-41900
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. • https://github.com/eclipse/jetty.project/pull/9528 https://github.com/eclipse/jetty.project/pull/9660 https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48 https://security.netapp.com/advisory/ntap-20231110-0004 https://www.debian.org/security/2023/dsa-5507 https://access.redhat.com/security/cve/CVE-2023-41900 https://bugzilla.redhat.com/show_bug.cgi?id=2247052 • CWE-287: Improper Authentication CWE-1390: Weak Authentication •
CVSS: 5.3EPSS: 0%CPEs: 12EXPL: 0CVE-2023-40167 – Jetty accepts "+" prefixed value in Content-Length
https://notcve.org/view.php?id=CVE-2023-40167
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. • https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6 https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html https://www.debian.org/security/2023/dsa-5507 https://www.rfc-editor.org/rfc/rfc9110#section-8.6 https://access.redhat.com/security/cve/CVE-2023-40167 https://bugzilla.redhat.com/show_bug.cgi?id=2239634 • CWE-130: Improper Handling of Length Parameter Inconsistency •