CVE-2023-29451 : Specially crafted string can cause a buffer overrun in the JSON parser library l

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.

Published 2023-07-13 10:15:09

Updated 2023-08-22 19:16:35

Source Zabbix

View at NVD, CVE.org

Vulnerability category: OverflowMemory CorruptionInput validation

Products affected by CVE-2023-29451

Zabbix » Zabbix
Versions up to, including, (<=) 6.0.14
cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix
Versions from including (>=) 6.4.2 and up to, including, (<=) 6.4.4
cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update Alpha1
cpe:2.3:a:zabbix:zabbix:6.4.0:alpha1:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update Beta1
cpe:2.3:a:zabbix:zabbix:6.4.0:beta1:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update Beta2
cpe:2.3:a:zabbix:zabbix:6.4.0:beta2:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update Beta3
cpe:2.3:a:zabbix:zabbix:6.4.0:beta3:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update Beta4
cpe:2.3:a:zabbix:zabbix:6.4.0:beta4:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update Beta5
cpe:2.3:a:zabbix:zabbix:6.4.0:beta5:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update Beta6
cpe:2.3:a:zabbix:zabbix:6.4.0:beta6:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update RC2
cpe:2.3:a:zabbix:zabbix:6.4.0:rc2:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update RC3
cpe:2.3:a:zabbix:zabbix:6.4.0:rc3:*:*:*:*:*:*
Matching versions
Zabbix » Zabbix » Version: 6.4.0 Update RC4
cpe:2.3:a:zabbix:zabbix:6.4.0:rc4:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 38 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	1.2	3.4	Zabbix
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: security@zabbix.com (Secondary)
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html

[SECURITY] [DLA 3538-1] zabbix security update

CVEs referencing this url
https://support.zabbix.com/browse/ZBX-22587

[ZBX-22587] JSONPath uses uninitialised buffer if JSON string contains invalid unicode character (CVE-2023-29451) - ZABBIX SUPPORT
Vendor Advisory

Jump to