Off-by-One Error in Memcached Proxy Mode - CVE-2023-46853
Summary
DEBIAN-CVE-2023-46853: In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n. Affects memcached versions < 1.6.22-1. Fixed in 1.6.22-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Memcached is a high-performance, distributed memory object caching system, primarily used to speed up dynamic web applications by alleviating database load. It allows developers to store data in memory for quick retrieval, making it a popular choice for enhancing application performance. However, vulnerabilities in its implementation can lead to security risks, such as the one identified in CVE-2023-46853, which affects versions prior to 1.6.22.
Vulnerability Detail
The vulnerability identified as CVE-2023-46853 is an off-by-one error that occurs when Memcached processes proxy requests in proxy mode. This error arises when the newline character '\n' is used instead of the expected '\r\n'. This can lead to unexpected behavior, potentially allowing an attacker to exploit the flaw to manipulate the server's response or cause a denial of service. The vulnerability affects both Debian 13 and 14 versions of Memcached, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
1.6.22-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade memcachedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using Memcached in proxy mode or ensure that requests are formatted correctly with '\r\n' instead of '\n'. This can help mitigate the risk until the package is updated.
Conclusion
CVE-2023-46853 poses a significant risk to users of Memcached versions prior to 1.6.22 due to an off-by-one error in proxy mode. It is crucial for users to update their installations to the latest version to protect against potential exploits. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for memcached →
FAQ
CVE-2023-46853 is a vulnerability in Memcached that involves an off-by-one error when processing proxy requests, which can lead to security issues.
Versions of Memcached prior to 1.6.22 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider avoiding the use of proxy mode or ensuring that requests are formatted correctly to mitigate the risk.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-46853.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for memcached.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
