What is CVE-2023-1992?

CVE-2023-1992 is a medium-severity software vulnerability (Uncontrolled resource consumption) with a CVSS score of 6.3. RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

Is CVE-2023-1992 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 5%.

What products does CVE-2023-1992 affect?

Tracked products affected include Wireshark. Check the version you run to see whether it is affected.

How do I fix CVE-2023-1992?

Apply the vendor fix in your normal patch cycle. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2023-1992

MEDIUM severity · CVSS 6.3 · Uncontrolled resource consumption

6.3CVSS MEDIUM

Summary

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactLow

Integrity impactLow

Availability impactLow

Exploit probability (EPSS)5%

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected products we track (1)

Wireshark

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: https://gitlab.com/wireshark/wireshark/-/issues/18852 ↗

Additional information

NVD record
https://gitlab.com/wireshark/wireshark/-/issues/18852Patch
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1992.jsonAdvisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00029.htmlAdvisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EHLTD25WNQSPQNELX52UH6YLP4TBLKTT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZA7IMATNNQPLIM6WMRPM3T5ZY24NRR2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFJERBHVWYLYWXO2B3V47QH66IEB6EZ3/
https://security.gentoo.org/glsa/202309-02Advisory
https://www.debian.org/security/2023/dsa-5429Advisory