CVE-2023-29046: Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged…

PriorityP422medium4.3CVSS 3.1

AVNACLPRLUINSUCNINAL

EPSS

0.48%

37.7th percentile

Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
open-xchange	open-xchange_appsuite	< 7.10.6	7.10.6
open-xchange	open-xchange_appsuite	—	—
ox_software_gmbh	ox_app_suite	<= 7.10.6-rev48	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.