CVE-2023-27478 : libmemcached-awesome is an open source C/C++ client library and tools for the me

libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key, if that previous request timed out due to a low `POLL_TIMEOUT`. This issue has been addressed in version 1.1.4. Users are advised to upgrade. There are several ways to workaround or lower the probability of this bug affecting a given deployment. 1: use a reasonably high `POLL_TIMEOUT` setting, like the default. 2: use separate libmemcached connections for unrelated data. 3: do not re-use libmemcached connections in an unknown state.

Published 2023-03-07 18:15:09

Updated 2023-03-23 16:59:14

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2023-27478

Awesome » Libmemcached
Versions from including (>=) 1.0.18 and before (<) 1.1.4
cpe:2.3:a:awesome:libmemcached:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-27478

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 43 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-27478

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	3.9	2.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	3.9	2.5	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2023-27478

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2023-27478

https://github.com/awesomized/libmemcached/security/advisories/GHSA-wwmh-39wj-fx59

Disclosure of unrelated data · Advisory · awesomized/libmemcached · GitHub
Patch;Third Party Advisory
https://github.com/awesomized/libmemcached/releases/tag/1.1.4

Release v 1.1.4 · awesomized/libmemcached · GitHub
Release Notes
https://github.com/php-memcached-dev/php-memcached/issues/531

get returns random values when lower than default OPT_POLL_TIMEOUT is set · Issue #531 · php-memcached-dev/php-memcached · GitHub
Exploit;Issue Tracking;Patch;Third Party Advisory
https://github.com/awesomized/libmemcached/commit/48dcc61a

revert most of d7a0084bf99d618d1dc26a54fd413db7ae8b8e63 · awesomized/libmemcached@48dcc61 · GitHub
Patch

Jump to

Vulnerability Details : CVE-2023-27478

Products affected by CVE-2023-27478

Exploit prediction scoring system (EPSS) score for CVE-2023-27478

CVSS scores for CVE-2023-27478

CWE ids for CVE-2023-27478

References for CVE-2023-27478