CVE-2023-1605 Denial of Service in radareorg/radare2
An attacker can cause a denial of service in radare2 by exploiting a flaw in the application, requiring users to upgrade to a patched version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1605?
CVE-2023-1605 is a high-severity denial of service vulnerability in Radare Radare2, published on 23 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
Weakness: CWE-400
Which versions are affected by CVE-2023-1605?
It affects 1 product.
Linux distribution packages (1)
radare2 openSUSE:Tumbleweed | All versions | 5.8.6-1.1 |
Products include Radare Radare2.
How do I fix CVE-2023-1605?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-1605 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1605 exists.
Other vulnerabilities in Radare Radare2
Sources
Also known as GHSA-88pw-p67x-2jrr, UBUNTU-CVE-2023-1605, openSUSE-SU-2024:12941-1.