Vulnerability · Published Apr 12, 2023 · Assigned by mitre
CVE-2023-28488
Medium 6.5
In plain English
A medium-severity security flaw in the connman package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.0%top 38.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | connman | 1.41-3 | DEBIAN-CVE-2023-28488 |
| Debian:13 | connman | 1.41-3 | DEBIAN-CVE-2023-28488 |
| Debian:14 | connman | 1.41-3 | DEBIAN-CVE-2023-28488 |
| Ubuntu:22.04:LTS | connman | 1.36-2.3ubuntu0.1 | USN-6236-1 |
| Ubuntu:22.04:LTS | connman | 1.36-2.3ubuntu0.1 | UBUNTU-CVE-2023-28488 |