CVE-2023-29046
First published: Thu Nov 02 2023(Updated: )
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.
Credit: security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6069 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6073 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6080 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6085 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6093 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6102 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6112 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6121 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6133 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6138 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6141 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6146 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6147 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6148 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6150 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6156 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6161 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6166 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6173 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6176 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6178 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6189 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6194 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6199 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6204 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6205 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6209 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6210 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6214 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6215 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6216 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6218 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6219 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6220 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6227 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6230 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6233 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6235 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6236 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6239 | |
| Open-Xchange App Suite Backend | =7.10.6-patch_release_6241 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-29046?
CVE-2023-29046 is a vulnerability where connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout and instead were logged.
What is the severity of CVE-2023-29046?
The severity of CVE-2023-29046 is medium, with a severity value of 4.3.
Which software is affected by CVE-2023-29046?
Open-xchange Open-xchange Appsuite versions up to 7.10.6 are affected by CVE-2023-29046.
How can I fix CVE-2023-29046?
To fix CVE-2023-29046, it is recommended to update to Open-xchange Open-xchange Appsuite version 7.10.6-patch_release_6243 or later.
- agent/type
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/softwarecombine
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/last-modified-date
- agent/source
- agent/description
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/open-xchange
- canonical/open-xchange app suite backend
- version/open-xchange app suite backend/7.10.6
- version/open-xchange app suite backend/7.10.6-patch_release_6069
- version/open-xchange app suite backend/7.10.6-patch_release_6073
- version/open-xchange app suite backend/7.10.6-patch_release_6080
- version/open-xchange app suite backend/7.10.6-patch_release_6085
- version/open-xchange app suite backend/7.10.6-patch_release_6093
- version/open-xchange app suite backend/7.10.6-patch_release_6102
- version/open-xchange app suite backend/7.10.6-patch_release_6112
- version/open-xchange app suite backend/7.10.6-patch_release_6121
- version/open-xchange app suite backend/7.10.6-patch_release_6133
- version/open-xchange app suite backend/7.10.6-patch_release_6138
- version/open-xchange app suite backend/7.10.6-patch_release_6141
- version/open-xchange app suite backend/7.10.6-patch_release_6146
- version/open-xchange app suite backend/7.10.6-patch_release_6147
- version/open-xchange app suite backend/7.10.6-patch_release_6148
- version/open-xchange app suite backend/7.10.6-patch_release_6150
- version/open-xchange app suite backend/7.10.6-patch_release_6156
- version/open-xchange app suite backend/7.10.6-patch_release_6161
- version/open-xchange app suite backend/7.10.6-patch_release_6166
- version/open-xchange app suite backend/7.10.6-patch_release_6173
- version/open-xchange app suite backend/7.10.6-patch_release_6176
- version/open-xchange app suite backend/7.10.6-patch_release_6178
- version/open-xchange app suite backend/7.10.6-patch_release_6189
- version/open-xchange app suite backend/7.10.6-patch_release_6194
- version/open-xchange app suite backend/7.10.6-patch_release_6199
- version/open-xchange app suite backend/7.10.6-patch_release_6204
- version/open-xchange app suite backend/7.10.6-patch_release_6205
- version/open-xchange app suite backend/7.10.6-patch_release_6209
- version/open-xchange app suite backend/7.10.6-patch_release_6210
- version/open-xchange app suite backend/7.10.6-patch_release_6214
- version/open-xchange app suite backend/7.10.6-patch_release_6215
- version/open-xchange app suite backend/7.10.6-patch_release_6216
- version/open-xchange app suite backend/7.10.6-patch_release_6218
- version/open-xchange app suite backend/7.10.6-patch_release_6219
- version/open-xchange app suite backend/7.10.6-patch_release_6220
- version/open-xchange app suite backend/7.10.6-patch_release_6227
- version/open-xchange app suite backend/7.10.6-patch_release_6230
- version/open-xchange app suite backend/7.10.6-patch_release_6233
- version/open-xchange app suite backend/7.10.6-patch_release_6235
- version/open-xchange app suite backend/7.10.6-patch_release_6236
- version/open-xchange app suite backend/7.10.6-patch_release_6239
- version/open-xchange app suite backend/7.10.6-patch_release_6241