CVE-2023-29046 Denial of service in OX App Suite
Attackers can exhaust network resources by triggering persistent connections to malicious endpoints, causing denial of service in OX App Suite.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29046?
CVE-2023-29046 is a medium-severity denial of service vulnerability in Open-Xchange Open-Xchange Appsuite, published on 2 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.
Weakness: CWE-400
Which versions are affected by CVE-2023-29046?
It affects 1 product.
Products include Open-Xchange Open-Xchange Appsuite.
How do I fix CVE-2023-29046?
No fix has been published for CVE-2023-29046 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-29046 being exploited?
There is no known exploitation of CVE-2023-29046 in the wild and no public exploit code.
Other vulnerabilities in Open-Xchange Open-Xchange Appsuite
Sources
Also known as GHSA-jcjp-p87g-594h.