CVE-2018-16789: High severity shellinabox vulnerability
Published Mar 17, 2019
·Updated
libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.
Affected Software
1 affected component
Shellinabox Project Shellinabox<=2.20
Remediation
Patch Available
Event History
Mar 17, 2019
CVE Published
via MITRE·06:36 PM
Data Sourced
via MITRE·06:36 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-16789?
CVE-2018-16789 is classified as a denial of service vulnerability.
2
How do I fix CVE-2018-16789?
To mitigate CVE-2018-16789, update Shellinabox to a version later than 2.20.
3
What impact does CVE-2018-16789 have?
CVE-2018-16789 can cause Shellinabox to enter an infinite loop, exhausting CPU resources and bringing down the service.
4
In which versions of Shellinabox does CVE-2018-16789 affect?
CVE-2018-16789 affects all versions of Shellinabox up to and including 2.20.
5
What specific component is vulnerable in CVE-2018-16789?
The vulnerability in CVE-2018-16789 resides in the HTTP request parsing logic of libhttp/url.c.