CVE-2023-0662 DoS vulnerability when parsing multipart request body
Attackers can cause denial of service by sending excessive multipart form parts, exhausting CPU or disk resources on servers using PHP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0662?
CVE-2023-0662 is a high-severity denial of service vulnerability in Php Php, published on 16 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.
Weakness: CWE-400
Which versions are affected by CVE-2023-0662?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.0.0 | 8.0.28, 8.1.16, 8.2.3 |
php Bitnami | From 8.0.0 | 8.0.28, 8.1.16, 8.2.3 |
php-min Bitnami | From 8.0.0 | 8.0.28, 8.1.16, 8.2.3 |
Products include Php Php.
How do I fix CVE-2023-0662?
Upgrade libphp to a fixed version for your release line: 8.0.28, 8.1.16 or 8.2.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-0662 being exploited?
There is no known exploitation of CVE-2023-0662 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as AZL-13605, BIT-libphp-2023-0662, BIT-php-2023-0662, BIT-php-min-2023-0662, DEBIAN-CVE-2023-0662, ECHO-b3f0-7c36-29f3 and 2 more.