CVE-2018-16789

2019-03-2116:00:22

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.8%

JSON

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.

OSVersionArchitecturePackageVersionFilename
Debian12allshellinabox< 2.21shellinabox_2.21_all.deb
Debian11allshellinabox< 2.21shellinabox_2.21_all.deb
Debian999allshellinabox< 2.21shellinabox_2.21_all.deb
Debian13allshellinabox< 2.21shellinabox_2.21_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	shellinabox	< 2.21	shellinabox_2.21_all.deb
Debian	11	all	shellinabox	< 2.21	shellinabox_2.21_all.deb
Debian	999	all	shellinabox	< 2.21	shellinabox_2.21_all.deb
Debian	13	all	shellinabox	< 2.21	shellinabox_2.21_all.deb