CVE-2022-23837
First published: Fri Jan 21 2022(Updated: )
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/sidekiq | <6.4.0 | 6.4.0 |
| debian/ruby-sidekiq | <=6.0.4+dfsg-2 | 6.4.1+dfsg-1 7.3.2+dfsg-1 |
| Sidekiq | <5.2.10 | |
| Sidekiq | >=6.0.0<6.4.0 | |
| Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md
- https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956
- https://github.com/rubysec/ruby-advisory-db/pull/495
- https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html
- https://security-tracker.debian.org/tracker/CVE-2022-23837
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23837
- https://access.redhat.com/errata/RHSA-2022:5498
- https://access.redhat.com/security/cve/cve-2022-23837
- https://bugzilla.redhat.com/show_bug.cgi?id=2044581
Frequently Asked Questions
What is CVE-2022-23837?
CVE-2022-23837 is a vulnerability in Sidekiq before 5.2.10 and 6.4.0 that allows an attacker to overload the system and make the Web UI unavailable.
What is the severity of CVE-2022-23837?
The severity of CVE-2022-23837 is high with a severity value of 7.5.
How does CVE-2022-23837 affect Sidekiq?
CVE-2022-23837 affects Sidekiq by allowing an attacker to overload the system when requesting stats for the graph.
What is the affected software for CVE-2022-23837?
The affected software for CVE-2022-23837 includes Sidekiq versions before 5.2.10 and 6.4.0, as well as certain Debian Linux and Ruby Sidekiq packages.
How can I fix CVE-2022-23837?
To fix CVE-2022-23837, you should update Sidekiq to version 5.2.10 or 6.4.0 depending on your current version.
- agent/type
- agent/remedy
- agent/references
- agent/weakness
- agent/author
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-23837
- agent/software-canonical-lookup
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- package-manager/debian
- vendor/contribsys
- canonical/sidekiq
- version/sidekiq/6.0.0
- vendor/debian
- canonical/debian linux
- version/debian linux/9.0