CVE-2023-29180: Null Pointer Dereference
First published: Thu Feb 22 2024(Updated: )
A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to denial of service via specially crafted HTTP requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=1.0.0<=1.0.7 | |
| Fortinet FortiProxy | >=1.1.0<=1.1.6 | |
| Fortinet FortiProxy | >=1.2.0<=1.2.13 | |
| Fortinet FortiProxy | >=2.0.0<2.0.13 | |
| Fortinet FortiProxy | >=7.0.0<7.0.11 | |
| Fortinet FortiProxy | >=7.2.0<7.2.4 | |
| Fortinet FortiOS IPS Engine | >=6.0.0<6.0.17 | |
| Fortinet FortiOS IPS Engine | >=6.2.0<6.2.15 | |
| Fortinet FortiOS IPS Engine | >=6.4.0<6.4.13 | |
| Fortinet FortiOS IPS Engine | >=7.0.0<7.0.12 | |
| Fortinet FortiOS IPS Engine | >=7.2.0<7.2.5 |
Remedy
Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.12 or above Please upgrade to FortiOS version 6.4.13 or above Please upgrade to FortiOS version 6.2.15 or above Please upgrade to FortiOS version 6.0.17 or above Please upgrade to FortiSASE version 22.4 or above Please upgrade to FortiProxy version 7.2.4 or above Please upgrade to FortiProxy version 7.0.11 or above Please upgrade to FortiProxy version 2.0.13 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-29180?
The severity of CVE-2023-29180 is considered to be high, as it involves a null pointer dereference that can lead to potential denial of service.
How do I fix CVE-2023-29180?
To fix CVE-2023-29180, you should update Fortinet FortiOS or FortiProxy to the latest versions that have addressed this vulnerability.
Which versions are affected by CVE-2023-29180?
CVE-2023-29180 affects Fortinet FortiOS versions 7.2.0 through 7.2.4 and 6.0.0 through 6.4.12, along with FortiProxy versions 7.0.0 through 7.2.3 and earlier.
What consequences can result from CVE-2023-29180?
CVE-2023-29180 can lead to a denial of service condition, causing affected systems to become unresponsive.
Is there a workaround for CVE-2023-29180 if I cannot update immediately?
Currently, there are no documented workarounds for CVE-2023-29180, and it is strongly recommended to apply the appropriate security updates as soon as possible.
- agent/remedy
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/1.0.0
- version/fortinet fortiproxy/1.0.7
- version/fortinet fortiproxy/1.1.0
- version/fortinet fortiproxy/1.1.6
- version/fortinet fortiproxy/1.2.0
- version/fortinet fortiproxy/1.2.13
- version/fortinet fortiproxy/2.0.0
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.2.0
- canonical/fortinet fortios ips engine
- version/fortinet fortios ips engine/6.0.0
- version/fortinet fortios ips engine/6.2.0
- version/fortinet fortios ips engine/6.4.0
- version/fortinet fortios ips engine/7.0.0
- version/fortinet fortios ips engine/7.2.0