Bug 1220403 (CVE-2024-23837) - VUL-0: CVE-2024-23837: libhtp: excessive processing time of HTTP headers can lead to denial of service
Summary: VUL-0: CVE-2024-23837: libhtp: excessive processing time of HTTP headers can ...
Status: RESOLVED FIXED
Alias: CVE-2024-23837
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Otto Hollmann
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/395171/
Whiteboard:
Keywords:
Depends on:
Blocks: 1224165
  Show dependency treegraph
 
Reported: 2024-02-27 09:29 UTC by SMASH SMASH
Modified: 2024-06-04 09:18 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-02-27 09:29:49 UTC
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23837
https://www.cve.org/CVERecord?id=CVE-2024-23837
https://github.com/OISF/libhtp/commit/20ac301d801cdf01b3f021cca08a22a87f477c4a
https://github.com/OISF/libhtp/security/advisories/GHSA-f9wf-rrjj-qx8m
https://redmine.openinfosecfoundation.org/issues/6444
Comment 1 Otto Hollmann 2024-02-28 09:42:02 UTC
Already in Factory
> https://build.opensuse.org/request/show/1149545

Assigning back to security team
Comment 2 Carlos López 2024-02-28 12:55:23 UTC
(In reply to Otto Hollmann from comment #1)
> Already in Factory
> > https://build.opensuse.org/request/show/1149545
> 
> Assigning back to security team

What about openSUSE:Backports:SLE-15-SP{4,5,6}?
Comment 3 Andreas Stieger 2024-06-01 20:44:40 UTC
(In reply to Carlos López from comment #2)
> What about openSUSE:Backports:SLE-15-SP{4,5,6}?

openSUSE has a weak model and tracking and following up here. Otto did not read your message: He was neither the assignee, nor CC'd on the bug, nor would the maintainer ever be pinged again unless someone looked at this randomly.

Re-assigning back to Maintainer to action. Here's a backport: https://build.opensuse.org/request/show/1178079
Comment 5 OBSbugzilla Bot 2024-06-03 08:15:03 UTC
This is an autogenerated message for OBS integration:
This bug (1220403) was mentioned in
https://build.opensuse.org/request/show/1178243 Backports:SLE-15-SP5+Backports:SLE-15-SP6 / libhtp
Comment 6 Marcus Meissner 2024-06-04 07:04:50 UTC
openSUSE-SU-2024:0150-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1220403
CVE References: CVE-2024-23837
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP5 (src):    libhtp-0.5.42-bp155.2.3.1
Comment 7 Andreas Stieger 2024-06-04 09:18:12 UTC
done