Bug 1220403 (CVE-2024-23837)

Summary: VUL-0: CVE-2024-23837: libhtp: excessive processing time of HTTP headers can lead to denial of service
Product: [openSUSE] openSUSE Distribution Reporter: SMASH SMASH <smash_bz>
Component: SecurityAssignee: Otto Hollmann <otto.hollmann>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: Andreas.Stieger, carlos.lopez
Version: Leap 15.6   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/395171/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1224165    

Description SMASH SMASH 2024-02-27 09:29:49 UTC 
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23837
https://www.cve.org/CVERecord?id=CVE-2024-23837
https://github.com/OISF/libhtp/commit/20ac301d801cdf01b3f021cca08a22a87f477c4a
https://github.com/OISF/libhtp/security/advisories/GHSA-f9wf-rrjj-qx8m
https://redmine.openinfosecfoundation.org/issues/6444
Comment 1 Otto Hollmann 2024-02-28 09:42:02 UTC 
Already in Factory
> https://build.opensuse.org/request/show/1149545

Assigning back to security team
Comment 2 Carlos López 2024-02-28 12:55:23 UTC 
(In reply to Otto Hollmann from comment #1)
> Already in Factory
> > https://build.opensuse.org/request/show/1149545
> 
> Assigning back to security team

What about openSUSE:Backports:SLE-15-SP{4,5,6}?
Comment 3 Andreas Stieger 2024-06-01 20:44:40 UTC 
(In reply to Carlos López from comment #2)
> What about openSUSE:Backports:SLE-15-SP{4,5,6}?

openSUSE has a weak model and tracking and following up here. Otto did not read your message: He was neither the assignee, nor CC'd on the bug, nor would the maintainer ever be pinged again unless someone looked at this randomly.

Re-assigning back to Maintainer to action. Here's a backport: https://build.opensuse.org/request/show/1178079
Comment 5 OBSbugzilla Bot 2024-06-03 08:15:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1220403) was mentioned in
https://build.opensuse.org/request/show/1178243 Backports:SLE-15-SP5+Backports:SLE-15-SP6 / libhtp
Comment 6 Marcus Meissner 2024-06-04 07:04:50 UTC 
openSUSE-SU-2024:0150-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1220403
CVE References: CVE-2024-23837
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP5 (src):    libhtp-0.5.42-bp155.2.3.1
Comment 7 Andreas Stieger 2024-06-04 09:18:12 UTC 
done