CVE-2023-29179: Null Pointer Dereference
First published: Thu Feb 22 2024(Updated: )
A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 allows attacker to denial of service via specially crafted HTTP requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FortiOS | >=6.4.0<6.4.13 | |
| FortiOS | >=7.0.0<7.0.12 | |
| FortiOS | >=7.2.0<7.2.5 | |
| Fortinet FortiProxy SSL VPN webmode | >=7.0.0<7.0.11 | |
| Fortinet FortiProxy SSL VPN webmode | >=7.2.0<7.2.5 |
Remedy
Please upgrade to FortiProxy version 7.2.5 or above Please upgrade to FortiProxy version 7.0.11 or above Please upgrade to FortiSASE version 22.4 or above Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.12 or above Please upgrade to FortiOS version 6.4.13 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-29179?
CVE-2023-29179 has been classified as a denial of service vulnerability, allowing attackers to disrupt service availability.
Which versions of Fortinet FortiOS are affected by CVE-2023-29179?
CVE-2023-29179 affects Fortinet FortiOS versions 7.2.0 to 7.2.4, 7.0.0 to 7.0.11, and 6.4.0 to 6.4.12.
How do I fix CVE-2023-29179?
To mitigate CVE-2023-29179, upgrade Fortinet FortiOS or FortiProxy to a version that is not affected, such as FortiOS 6.4.13 or later.
What impact does CVE-2023-29179 have if exploited?
If exploited, CVE-2023-29179 can lead to a denial of service condition, making affected services unavailable.
Is FortiProxy also affected by CVE-2023-29179?
Yes, CVE-2023-29179 affects FortiProxy versions 7.2.0 to 7.2.4 and 7.0.0 to 7.0.10.
- agent/remedy
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/fortinet
- canonical/fortios
- version/fortios/6.4.0
- version/fortios/7.0.0
- version/fortios/7.2.0
- canonical/fortinet fortiproxy ssl vpn webmode
- version/fortinet fortiproxy ssl vpn webmode/7.0.0
- version/fortinet fortiproxy ssl vpn webmode/7.2.0