SB2024121746 - Denial of service in BIG-IP Next SPK/CNF Python http.cookies module

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024121746

SB2024121746 - Denial of service in BIG-IP Next SPK/CNF Python http.cookies module

Published: December 17, 2024

Security Bulletin ID SB2024121746
CSH Severity
Low
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Resource exhaustion (CVE-ID: CVE-2024-7592)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the 'http.cookies' standard library module when parsing cookies that contained backslashes for quoted characters in the cookie value. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References