CVE-2024-11148 | THREATINT

Description

In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request.

Reserved 2024-11-12 | Published 2024-12-05 | Updated 2024-12-06 | Assigner cisa-cg

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y

Problem types

CWE-476 NULL Pointer Dereference

Product status

Default status

affected

7.4 before 7.4 errata 006

affected

7.4 errata 006

unaffected

7.3 before 7.3 errata 020

affected

7.3 errata 020

unaffected

References

ftp.openbsd.org/...SD/patches/7.4/common/006_httpd.patch.sig (url)

ftp.openbsd.org/...SD/patches/7.3/common/020_httpd.patch.sig (url)

cve.org (CVE-2024-11148)

nvd.nist.gov (CVE-2024-11148)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.