CVE-2019-3833

Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name	Vendor	Start Version	End Version
Openwsman	Openwsman_project	*	2.6.9 (including)
Red Hat Enterprise Linux 7	RedHat	openwsman-0:2.6.3-7.git4391e5c.el7	*
Red Hat Enterprise Linux 8	RedHat	openwsman-0:2.6.5-7.el8	*
Openwsman	Ubuntu	bionic	*
Openwsman	Ubuntu	cosmic	*
Openwsman	Ubuntu	devel	*
Openwsman	Ubuntu	disco	*
Openwsman	Ubuntu	eoan	*
Openwsman	Ubuntu	esm-apps/bionic	*
Openwsman	Ubuntu	esm-apps/focal	*
Openwsman	Ubuntu	esm-apps/jammy	*
Openwsman	Ubuntu	esm-apps/noble	*
Openwsman	Ubuntu	esm-apps/xenial	*
Openwsman	Ubuntu	focal	*
Openwsman	Ubuntu	groovy	*
Openwsman	Ubuntu	hirsute	*
Openwsman	Ubuntu	impish	*
Openwsman	Ubuntu	jammy	*
Openwsman	Ubuntu	kinetic	*
Openwsman	Ubuntu	lunar	*
Openwsman	Ubuntu	mantic	*
Openwsman	Ubuntu	noble	*
Openwsman	Ubuntu	oracular	*
Openwsman	Ubuntu	plucky	*
Openwsman	Ubuntu	questing	*
Openwsman	Ubuntu	trusty	*
Openwsman	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2019-3833
CWE	https://cwe.mitre.org/data/definitions/835.html

Loop with Unreachable Exit Condition ('Infinite Loop')

Weakness

Affected Software

References