CVE-2023-37279

CVSS V2 None CVSS V3 None
Description
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.
Overview
  • CVE ID
  • CVE-2023-37279
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-09-20T21:27:22.188Z
  • Last Modified Date
  • 2023-09-20T21:27:22.188Z
Weakness Enumerations
CWE URL
CWE-770 http://cwe.mitre.org/data/definitions/770.html
CWE-789 http://cwe.mitre.org/data/definitions/789.html
References
Reference URL Reference Tags
https://github.com/contribsys/faktory/security/advisories/GHSA-x4hh-vjm7-g2jv x_refsource_CONFIRM
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-37279
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37279
History
Created Old Value New Value Data Type Notes
2024-06-25 01:21:51 Added to TrackCVE