CVE-2007-1869 — Infinite Loop in Lighttpd

5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
5.8%
top 9.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
LighttpdDebian Lighttpd
Timeline
PublishedApr 18
Latest updateMay 1

Description

lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/lighttpd< lighttpd 1.4.15-1 (bookworm)
▶Debianlighttpd/lighttpd< 1.4.15-1+3
▶NVDlighttpd/lighttpd1.4.12, 1.4.13+1

Patches

Patch: www.lighttpd.net ↗Patch: www.lighttpd.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-7mcc-f855-qrgf: lighttpd 1↗2022-05-01
▶
OSV
CVE-2007-1869: lighttpd 1↗2007-04-18
▶

📋Vendor Advisories

1
Debian
CVE-2007-1869: lighttpd - lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service ...↗2007
▶

💬Community

1
Bugzilla
CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities↗2007-04-15
▶