CVE-2023-52557: OpenBSD 7.3 invalid l2tp message npppd crash
Published Mar 1, 2024
·Updated
In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.
Affected Software
18 affected components
OpenBSD OpenBSD<7.3
OpenBSD OpenBSD<7.3
OpenBSD OpenBSD=7.3
OpenBSD OpenBSD=7.3-errata_001
OpenBSD OpenBSD=7.3-errata_002
OpenBSD OpenBSD=7.3-errata_003
OpenBSD OpenBSD=7.3-errata_004
OpenBSD OpenBSD=7.3-errata_005
OpenBSD OpenBSD=7.3-errata_006
OpenBSD OpenBSD=7.3-errata_007
OpenBSD OpenBSD=7.3-errata_008
OpenBSD OpenBSD=7.3-errata_009
OpenBSD OpenBSD=7.3-errata_010
OpenBSD OpenBSD=7.3-errata_011
OpenBSD OpenBSD=7.3-errata_012
OpenBSD OpenBSD=7.3-errata_013
OpenBSD OpenBSD=7.3-errata_014
OpenBSD OpenBSD=7.3-errata_015
Remediation
Event History
Mar 1, 2024
CVE Published
via MITRE·04:14 PM
Data Sourced
via MITRE·04:14 PM
DescriptionWeakness
Data Sourced
via NVD·05:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-52557?
CVE-2023-52557 is considered a moderate severity vulnerability due to the potential for npppd to crash when processing malicious l2tp messages.
2
How do I fix CVE-2023-52557?
To fix CVE-2023-52557, apply errata 016 or update to a version of OpenBSD later than 7.3.
3
Which versions of OpenBSD are affected by CVE-2023-52557?
CVE-2023-52557 affects OpenBSD versions prior to errata 016 in version 7.3.
4
What components are impacted by CVE-2023-52557?
CVE-2023-52557 impacts the npppd component in OpenBSD, specifically related to handling l2tp messages.
5
Is there a workaround for CVE-2023-52557?
Currently, there are no documented workarounds for CVE-2023-52557 aside from patching or upgrading the affected software.