Input validation error in css-tools - CVE-2023-26364

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU84457

Input validation error in css-tools - CVE-2023-26364

Published: December 15, 2023


Vulnerability identifier: #VU84457
CSH Severity: Medium
CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-26364
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability occurs when attempting to parse CSS. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Affected software

css-tools
Cloud Pak for Network Automation
IBM Planning Analytics Workspace
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Migration Toolkit for Runtimes
Red Hat Migration Toolkit for Applications
cockpit-wicked
OpenShift Data Foundation (formerly OpenShift Container Storage)

How to mitigate CVE-2023-26364

Install updates from vendor's website.

css-tools - update to 4.3.2
Migration Toolkit for Runtimes - update to 1.2.6
IBM Planning Analytics Workspace - update to 2.0.93
cockpit-wicked - addressed in versions 4.5-150400.3.3.1, 5~git8.c06c55b-150500.3.3.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.14.13, 4.15.9, 4.16.5, 4.17.0
Red Hat Migration Toolkit for Applications - addressed in versions 6.2.3, 7.0.3

External References

Related Security Bulletins