CVE-2023-36461 - OpenCVE

Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Joinmastodon	Mastodon

Configuration 1 [-]

OR	cpe:2.3:a:joinmastodon:mastodon::::::::
	cpe:2.3:a:joinmastodon:mastodon::::::::
	cpe:2.3:a:joinmastodon:mastodon::::::::

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2023/07/06/7
https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6
https://github.com/mastodon/mastodon/releases/tag/v3.5.9
https://github.com/mastodon/mastodon/releases/tag/v4.0.5
https://github.com/mastodon/mastodon/releases/tag/v4.1.3
https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-07-06T18:57:59.160Z

Updated: 2024-08-02T16:45:56.828Z

Reserved: 2023-06-21T18:50:41.699Z

Link: CVE-2023-36461

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-07-06T19:15:10.880

Modified: 2023-07-14T19:25:23.220

Link: CVE-2023-36461

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-36461", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-06-21T18:50:41.699Z", "datePublished": "2023-07-06T18:57:59.160Z", "dateUpdated": "2024-08-02T16:45:56.828Z"}, "containers": {"cna": {"title": "Mastodon vulnerable to Denial of Service through slow HTTP responses", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc"}, {"name": "https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v3.5.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v3.5.9"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.0.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.0.5"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.1.3"}, {"url": "http://www.openwall.com/lists/oss-security/2023/07/06/7"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": "< 3.5.9", "status": "affected"}, {"version": ">= 4.0.0, < 4.0.5", "status": "affected"}, {"version": ">= 4.1.0, < 4.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-07-06T18:57:59.160Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue."}], "source": {"advisory": "GHSA-9pxv-6qvf-pjwc", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:45:56.828Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc"}, {"name": "https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v3.5.9", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mastodon/mastodon/releases/tag/v3.5.9"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.0.5", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.0.5"}, {"name": "https://github.com/mastodon/mastodon/releases/tag/v4.1.3", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.1.3"}, {"url": "http://www.openwall.com/lists/oss-security/2023/07/06/7", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDD53D86-018D-4C06-94B3-36E2FDE03963", "versionEndExcluding": "3.5.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "51150E6A-F99E-4905-A464-2BAC2B1C36C3", "versionEndExcluding": "4.0.5", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "8AB4CC5C-A9AE-4CD1-8912-B570E2F6E170", "versionEndExcluding": "4.1.3", "versionStartIncluding": "4.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue."}], "id": "CVE-2023-36461", "lastModified": "2023-07-14T19:25:23.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-07-06T19:15:10.880", "references": [{"source": "security-advisories@github.com", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2023/07/06/7"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/mastodon/mastodon/releases/tag/v3.5.9"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.0.5"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/mastodon/mastodon/releases/tag/v4.1.3"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Primary"}]}