Denial of Service Vulnerability in Wireshark Due to HTTP3 Dissector Crash
Summary
DEBIAN-CVE-2024-0207: HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file. Affects wireshark versions < 4.2.2-1. Fixed in 4.2.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used network protocol analyzer that enables users to capture and interactively browse the traffic running on a computer network. It is essential for network troubleshooting, analysis, software and communications protocol development, and education. The vulnerability in question affects Wireshark versions prior to 4.2.2-1, specifically in its HTTP3 dissector, which can lead to a crash when processing certain packets.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-0207 allows for a denial of service (DoS) condition in Wireshark 4.2.0. This issue arises from a flaw in the HTTP3 dissector, which can be exploited through packet injection or by using a crafted capture file. If an attacker sends specially crafted packets to a Wireshark instance, it may cause the application to crash, disrupting network analysis and monitoring activities.
How To Fix
Minimum fixed version
4.2.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted or suspicious capture files and refrain from analyzing packets from untrusted sources until the software is updated.
Conclusion
In summary, the vulnerability in Wireshark's HTTP3 dissector poses a significant risk of denial of service. Users are strongly advised to update to version 4.2.2-1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for wireshark →
FAQ
The vulnerability can lead to a denial of service, causing Wireshark to crash when processing malicious packets.
You can check your version of Wireshark by running 'wireshark -v' in the terminal. If it is below 4.2.2-1, it is affected.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, avoid using Wireshark to analyze untrusted packets or capture files until the software is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
