Inconsistent interpretation of HTTP requests in Gevent - CVE-2023-41419

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU82969

Inconsistent interpretation of HTTP requests in Gevent - CVE-2023-41419

Published: November 10, 2023


Vulnerability identifier: #VU82969
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-41419
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests within keep-alive connection. A remote attacker can send several HTTP request to the server, bypass implemented filtration and smuggle arbitrary HTTP requests to the library.



Affected software

Gevent
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openEuler
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python-gevent
python-gevent-debugsource
python-gevent-debuginfo
python3-gevent
python-gevent (Red Hat package)
python2-gevent-debuginfo
python3-gevent-debuginfo
python2-gevent
python-gevent-help
QRadar User Behavior Analytics
IBM Maximo Application Suite
IBM Cloud Pak for Watson AIOps

How to mitigate CVE-2023-41419

Install updates from vendor's website.

Gevent - update to 23.9.0
IBM Cloud Pak for Multicloud Management - update to 2.3.8
python-gevent - addressed in versions 1.1.2-3.3.1, 1.3.5-3.3.1
python-gevent-debugsource - addressed in versions 1.1.2-3.3.1, 1.2.2-150000.5.3.1, 1.3.5-3.3.1
python-gevent-debuginfo - addressed in versions 1.1.2-3.3.1, 1.2.2-150000.5.3.1, 1.3.5-3.3.1
python3-gevent - addressed in versions 1.2.2-5, 23.9.1-1
python-gevent (Red Hat package) - addressed in versions 1.2.2-5.el8_2, 1.2.2-5.el8_4, 1.2.2-5.el8_6, 1.2.2-5.el8_8, 1.2.2-5.el8_10, 21.1.2-2.el9ost
python3-gevent - update to 1.2.2-150000.5.3.1
python2-gevent-debuginfo - update to 1.2.2-150000.5.3.1
python3-gevent-debuginfo - update to 1.2.2-150000.5.3.1
python2-gevent - update to 1.2.2-150000.5.3.1
QRadar User Behavior Analytics - update to 4.1.16
IBM Cloud Pak for Watson AIOps - update to 4.2.1
Red Hat OpenShift Container Platform - update to 4.12.67
IBM Maximo Application Suite - addressed in versions 8.10.6, 8.11.1
python-gevent - addressed in versions 20.6.1-2, 21.1.2-2
python-gevent-help - addressed in versions 20.6.1-2, 21.1.2-2
python-gevent-debugsource - addressed in versions 20.6.1-2, 21.1.2-2
python3-gevent - addressed in versions 20.6.1-2, 21.1.2-2
python-gevent-debuginfo - addressed in versions 20.6.1-2, 21.1.2-2

External References

Related Security Bulletins