CVE-2023-1992
First published: Wed Apr 12 2023(Updated: )
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Credit: cve@gitlab.com cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wireshark Wireshark | >=3.6.0<3.6.13 | |
| Wireshark Wireshark | >=4.0.0<4.0.5 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =12.0 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 | |
| Fedoraproject Fedora | =38 | |
| debian/wireshark | <=2.6.20-0+deb10u4<=3.4.10-0+deb11u1 | 2.6.20-0+deb10u7 4.0.6-1~deb12u1 4.0.10-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1992.json
- https://gitlab.com/wireshark/wireshark/-/issues/18852
- https://lists.debian.org/debian-lts-announce/2023/04/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EHLTD25WNQSPQNELX52UH6YLP4TBLKTT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FZA7IMATNNQPLIM6WMRPM3T5ZY24NRR2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFJERBHVWYLYWXO2B3V47QH66IEB6EZ3/
- https://security.gentoo.org/glsa/202309-02
- https://www.debian.org/security/2023/dsa-5429
- https://www.wireshark.org/security/wnpa-sec-2023-09.html
- https://security-tracker.debian.org/tracker/CVE-2023-1992
Frequently Asked Questions
What is CVE-2023-1992?
CVE-2023-1992 is a vulnerability in Wireshark versions 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 that allows denial of service through packet injection or crafted capture file.
How can this vulnerability be exploited?
This vulnerability can be exploited through packet injection or by using a crafted capture file.
What is the severity level of CVE-2023-1992?
CVE-2023-1992 has a severity level of high with a CVSS score of 7.5.
Which software versions are affected by this vulnerability?
Wireshark versions 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 are affected by this vulnerability.
How can I fix CVE-2023-1992?
To fix CVE-2023-1992, update your Wireshark software to version 4.0.5 or later.
- collector/nvd-api
- collector/security-tracker-debian
- collector/nvd-index
- vendor/wireshark
- canonical/wireshark wireshark
- version/wireshark wireshark/3.6.0
- version/wireshark wireshark/4.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/12.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37
- version/fedoraproject fedora/38
- package-manager/debian