CVE-2023-25824

2023-02-2322:15:11

CWE-835

GitHub_M

web.nvd.nist.gov

cve-2023-25824

mod_gnutls

tls module

apache httpd

gnutls

denial of service

excessive log output

security advisory

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

30.2%

JSON

Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations on TLS connections when the transport hit timeouts. Instead it entered an endless loop retrying the read operation, consuming CPU resources. This could be exploited for denial of service attacks. If trace level logging was enabled, it would also produce an excessive amount of log output during the loop, consuming disk space. The problem has been fixed in commit d7eec4e598158ab6a98bf505354e84352f9715ec, please update to version 0.12.1. There are no workarounds, users who cannot update should apply the errno fix detailed in the security advisory.

Affected configurations

Nvd

Vulners

Node

mod_gnutls_projectmod_gnutlsRange0.9.0–0.12.1

VendorProductVersionCPE
mod_gnutls_projectmod_gnutls*cpe:2.3:a:mod_gnutls_project:mod_gnutls:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mod_gnutls_project	mod_gnutls	*	cpe:2.3:a:mod_gnutls_project:mod_gnutls::::::::

CNA Affected

[
  {
    "vendor": "airtower-luna",
    "product": "mod_gnutls",
    "versions": [
      {
        "version": ">= 0.9.0, < 0.12.1",
        "status": "affected"
      }
    ]
  }
]