CVE-2023-1993
published 2023-04-12CVE-2023-1993: LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
4.09%
90.7th percentile
LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| crypto-js_project | crypto-js | >= 0 < 4.2.0 | 4.2.0 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | wireshark | < wireshark 4.0.6-1~deb12u1 (bookworm) | wireshark 4.0.6-1~deb12u1 (bookworm) |
| entronad | crypto-es | >= 0 < 2.1.0 | 2.1.0 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| wireshark | wireshark | >= 0 < 3.4.16-0+deb11u1 | 3.4.16-0+deb11u1 |
| wireshark | wireshark | >= 0 < 4.0.6-1~deb12u1 | 4.0.6-1~deb12u1 |
| wireshark | wireshark | >= 0 < 4.0.6-1 | 4.0.6-1 |
| wireshark | wireshark | >= 0 < 4.0.6-1 | 4.0.6-1 |
| wireshark | wireshark | >= 3.6.0 < 3.6.13 | 3.6.13 |
| wireshark | wireshark | >= 4.0.0 < 4.0.5 | 4.0.5 |
| wireshark_foundation | wireshark | — | — |
| wireshark_foundation | wireshark | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_redhat9.1CRITICAL
vendor_debian6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
ghsa·2023-10-25
CVE-2023-46133 [CRITICAL] CWE-327 crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
### Impact
#### Summary
Crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and [at least 1,300,000 times weaker than current industry standard][OWASP PBKDF2 Cheatsheet]. This is because it both (1) defaults to [SHA1][SHA1 wiki], a cryptographic hash algorithm considered insecure [since at least 2005][Cryptanalysis of SHA-1] and (2) defaults to [one single iteration][one iteration src], a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to [preimage][preimage attack] and [collision][collision attack] attacks. Remediation of this issue might be very difficult, as the changes required to f
GHSA
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
ghsa·2023-10-25
CVE-2023-46233 [CRITICAL] CWE-327 crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
### Impact
#### Summary
Crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and [at least 1,300,000 times weaker than current industry standard][OWASP PBKDF2 Cheatsheet]. This is because it both (1) defaults to [SHA1][SHA1 wiki], a cryptographic hash algorithm considered insecure [since at least 2005][Cryptanalysis of SHA-1] and (2) defaults to [one single iteration][one iteration src], a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to [preimage][preimage attack] and [collision][collision attack] attacks.
Potential Impact:
1. If used to protect passwords, the impact is high.
2. If
OSV
CVE-2023-1993: LISP dissector large loop in Wireshark 4
osv·2023-04-12·CVSS 6.5
CVE-2023-1993 [MEDIUM] CVE-2023-1993: LISP dissector large loop in Wireshark 4
LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
GHSA
GHSA-h4rg-h5cx-4r4w: LISP dissector large loop in Wireshark 4
ghsa_unreviewed·2023-04-12
CVE-2023-1993 [MEDIUM] CWE-834 GHSA-h4rg-h5cx-4r4w: LISP dissector large loop in Wireshark 4
LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Red Hat
crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
vendor_redhat·2023-10-25·CVSS 9.1
CVE-2023-46233 [CRITICAL] CWE-328 crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a wo
Red Hat
wireshark: LISP dissector large loop
vendor_redhat·2023-04-12·CVSS 6.3
CVE-2023-1993 [MEDIUM] CWE-400 wireshark: LISP dissector large loop
wireshark: LISP dissector large loop
LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Package: wireshark (Red Hat Enterprise Linux 6) - Out of support scope
Package: wireshark (Red Hat Enterprise Linux 7) - Out of support scope
Package: wireshark (Red Hat Enterprise Linux 8) - Fix deferred
Package: wireshark (Red Hat Enterprise Linux 9) - Fix deferred
Debian
CVE-2023-1993: wireshark - LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows...
vendor_debian·2023·CVSS 6.3
CVE-2023-1993 [MEDIUM] CVE-2023-1993: wireshark - LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows...
LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Scope: local
bookworm: resolved (fixed in 4.0.6-1~deb12u1)
bullseye: resolved (fixed in 3.4.16-0+deb11u1)
forky: resolved (fixed in 4.0.6-1)
sid: resolved (fixed in 4.0.6-1)
trixie: resolved (fixed in 4.0.6-1)
No detection rules found.
No public exploits indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1993.jsonhttps://gitlab.com/wireshark/wireshark/-/issues/18900https://lists.debian.org/debian-lts-announce/2023/04/msg00029.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EHLTD25WNQSPQNELX52UH6YLP4TBLKTT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZA7IMATNNQPLIM6WMRPM3T5ZY24NRR2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFJERBHVWYLYWXO2B3V47QH66IEB6EZ3/https://security.gentoo.org/glsa/202309-02https://www.debian.org/security/2023/dsa-5429https://www.wireshark.org/security/wnpa-sec-2023-10.htmlhttps://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1993.jsonhttps://gitlab.com/wireshark/wireshark/-/issues/18900https://lists.debian.org/debian-lts-announce/2023/04/msg00029.htmlhttps://lists.debian.org/debian-lts-announce/2024/09/msg00049.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EHLTD25WNQSPQNELX52UH6YLP4TBLKTT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZA7IMATNNQPLIM6WMRPM3T5ZY24NRR2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFJERBHVWYLYWXO2B3V47QH66IEB6EZ3/https://security.gentoo.org/glsa/202309-02https://www.debian.org/security/2023/dsa-5429https://www.wireshark.org/security/wnpa-sec-2023-10.html
2023-04-12
Published