Vulnerability · Published Mar 7, 2023 · Assigned by GitHub_M
CVE-2023-27478Disclosure of unrelated data in libmemcached-awesome
Medium 6.5
In plain English
A medium-severity information exposure in libmemcached from awesomized. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key, if that previous request timed out due to a low `POLL_TIMEOUT`. This issue has been addressed in version 1.1.4. Users are advised to upgrade. There are several ways to workaround or lower the probability of this bug affecting a given deployment. 1: use a reasonably high `POLL_TIMEOUT` setting, like the default. 2: use separate libmemcached connections for unrelated data. 3: do not re-use libmemcached connections in an unknown state.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libmemcached | 1.1.4-1 | DEBIAN-CVE-2023-27478 |
| Debian:13 | libmemcached | 1.1.4-1 | DEBIAN-CVE-2023-27478 |
| Debian:14 | libmemcached | 1.1.4-1 | DEBIAN-CVE-2023-27478 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| awesomized | libmemcached | > 1.0.18, < 1.1.4 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/awesomized/libmemcached/security/advisories/GHSA-wwmh-39wj-fx59 x_refsource_CONFIRM
- https://github.com/php-memcached-dev/php-memcached/issues/531 x_refsource_MISC
- https://github.com/awesomized/libmemcached/commit/48dcc61a x_refsource_MISC
- https://github.com/awesomized/libmemcached/releases/tag/1.1.4 x_refsource_MISC