UBUNTU-CVE-2023-41101

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2023-41101
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-41101.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2023-41101
Related
Published
2023-11-17T06:15:00Z
Modified
2024-10-15T14:11:43Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in the captive portal in OpenNDS before version 10.1.3. getquery in httpmicrohttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions 10.x and later. Attackers may exploit the issue to crash OpenNDS (Denial-of-Service condition) or to inject and execute arbitrary bytecode (Remote Code Execution). Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and OpenWrt 23.05 on 23. November by updating OpenNDS to version 10.2.0.

References

Affected packages

Ubuntu:24.10 / opennds

Package

Name
opennds
Purl
pkg:deb/ubuntu/opennds?arch=src?distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

10.*

10.2.0+dfsg-1build2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / opennds

Package

Name
opennds
Purl
pkg:deb/ubuntu/opennds?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.10.0-1

10.*

10.2.0+dfsg-1
10.2.0+dfsg-1build1
10.2.0+dfsg-1build2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}