CVE-2023-48950 - virtuoso-opensource: Improper interpretation of input arguments in ins_vec_agg() in libsrc/Wi/sqlintrp.c

Back Back to CVE browser

HIGH

virtuoso-opensource: Improper interpretation of input arguments in ins_vec_agg() in libsrc/Wi/sqlintrp.c

Published Nov 29, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.90%

Description

An issue in the box_col_len function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.

Affected products

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	virtuoso-opensource	Out of support scope	n/a

Remediation

Red Hat statement

Red Hat ships virtuoso-opensource only in RHEL 7, which is no longer supported within our support scope.

Weaknesses (1)

CWE-115

References (5)

https://access.redhat.com/security/cve/CVE-2023-48950
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2253132
Issue Tracking
https://github.com/openlink/virtuoso-opensource/issues/1174
ExploitIssue TrackingPatch
https://nvd.nist.gov/vuln/detail/CVE-2023-48950
https://www.cve.org/CVERecord?id=CVE-2023-48950

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-48950		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2253132		Issue Tracking
https://github.com/openlink/virtuoso-opensource/issues/1174		ExploitIssue TrackingPatch
https://nvd.nist.gov/vuln/detail/CVE-2023-48950
https://www.cve.org/CVERecord?id=CVE-2023-48950

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 29, 2023

Updated Aug 2, 2024

Reserved Nov 20, 2023

Link CVE-2023-48950

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-48950

Red Hat

Severity Low

Public date Nov 29, 2023

Links CVE-2023-48950 - Bugzilla