CVE-2023-49606 - OpenCVE

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/05/07/1
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889

History

No history.

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2024-05-01T15:31:01.499Z

Updated: 2024-08-02T22:01:25.811Z

Reserved: 2023-12-05T17:05:52.210Z

Link: CVE-2023-49606

Vulnrichment

Updated: 2024-08-02T22:01:25.811Z

NVD

Status : Awaiting Analysis

Published: 2024-05-01T16:15:07.257

Modified: 2024-05-07T12:15:09.413

Link: CVE-2023-49606

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-49606", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2023-12-05T17:05:52.210Z", "datePublished": "2024-05-01T15:31:01.499Z", "dateUpdated": "2024-08-02T22:01:25.811Z"}, "containers": {"cna": {"affected": [{"vendor": "Tinyproxy", "product": "Tinyproxy", "versions": [{"version": "1.11.1", "status": "affected"}, {"version": "Tinyproxy 1.10.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-416: Use After Free", "type": "CWE", "cweId": "CWE-416"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-05-01T17:00:16.786Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889"}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/07/1"}], "credits": [{"lang": "en", "value": "Discovered by Dimitrios Tatsis of Cisco Talos."}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-49606", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-08T13:44:20.408622Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:tinyproxy:tinyproxy:1.10.0:*:*:*:*:*:*:*"], "vendor": "tinyproxy", "product": "tinyproxy", "versions": [{"status": "affected", "version": "1.10.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:tinyproxy:tinyproxy:1.11.1:*:*:*:*:*:*:*"], "vendor": "tinyproxy", "product": "tinyproxy", "versions": [{"status": "affected", "version": "1.11.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:27:48.362Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:01:25.811Z"}, "title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/07/1", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/07/1", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:01:25.811Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-49606", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-08T13:44:20.408622Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:tinyproxy:tinyproxy:1.10.0:*:*:*:*:*:*:*"], "vendor": "tinyproxy", "product": "tinyproxy", "versions": [{"status": "affected", "version": "1.10.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:tinyproxy:tinyproxy:1.11.1:*:*:*:*:*:*:*"], "vendor": "tinyproxy", "product": "tinyproxy", "versions": [{"status": "affected", "version": "1.11.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-06T15:21:03.272Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"credits": [{"lang": "en", "value": "Discovered by Dimitrios Tatsis of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Tinyproxy", "product": "Tinyproxy", "versions": [{"status": "affected", "version": "1.11.1"}, {"status": "affected", "version": "Tinyproxy 1.10.0"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889"}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/07/1"}], "descriptions": [{"lang": "en", "value": "A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-05-01T17:00:16.786Z"}}}, "cveMetadata": {"cveId": "CVE-2023-49606", "state": "PUBLISHED", "dateUpdated": "2024-08-02T22:01:25.811Z", "dateReserved": "2023-12-05T17:05:52.210Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2024-05-01T15:31:01.499Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}