CVE-2023-34054

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2023-34054	Vendor Advisory
https://spring.io/security/cve-2023-34054	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:pivotal:reactor_netty::::::::
	cpe:2.3:a:pivotal:reactor_netty::::::::

History

21 Nov 2024, 08:06

Type	Values Removed	Values Added
References	~~() https://spring.io/security/cve-2023-34054 - Vendor Advisory~~	() https://spring.io/security/cve-2023-34054 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 5.3

04 Dec 2023, 19:59

Type	Values Removed	Values Added
CPE		cpe:2.3:a:pivotal:reactor_netty::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~() https://spring.io/security/cve-2023-34054 -~~	() https://spring.io/security/cve-2023-34054 - Vendor Advisory
CWE		NVD-CWE-noinfo

28 Nov 2023, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-28 09:15

Updated : 2024-11-21 08:06

NVD link : CVE-2023-34054

Mitre link : CVE-2023-34054

CVE.ORG link : CVE-2023-34054

JSON object : View

Products Affected

pivotal

reactor_netty

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-34054", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-11-28T09:15:07.147", "references": [{"url": "https://spring.io/security/cve-2023-34054", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}, {"url": "https://spring.io/security/cve-2023-34054", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "\nIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.\n\n\n\n\n"}, {"lang": "es", "value": "En Reactor Netty HTTP Server, versiones 1.1.x anteriores a 1.1.13 y versiones 1.0.x anteriores a 1.0.39, es posible que un usuario proporcione solicitudes HTTP especialmente manipuladas que pueden causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS). Espec\u00edficamente, una aplicaci\u00f3n es vulnerable si la integraci\u00f3n integrada del servidor HTTP Reactor Netty con Micrometer est\u00e1 habilitada."}], "lastModified": "2024-11-21T08:06:29.087", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pivotal:reactor_netty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCFB064D-FAE3-4EB7-9B1F-327C9F4244EF", "versionEndExcluding": "1.0.39"}, {"criteria": "cpe:2.3:a:pivotal:reactor_netty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C4793FB-0D8F-4B59-A9A7-22CFCA249735", "versionEndExcluding": "1.1.13", "versionStartIncluding": "1.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}