CVE-2019-3833

Name of the Vulnerable Software and Affected Versions Openwsman versions up to and including 2.6.9

Description The issue is related to an infinite loop in the process connection() function when parsing specially crafted HTTP requests, such as /api/v1/login. A remote, unauthenticated attacker can exploit this by sending a malicious HTTP request to cause a denial of service to the openwsman server. The vulnerability is also associated with resource management errors.

Recommendations For Openwsman versions up to and including 2.6.9, consider disabling the process connection() function as a temporary workaround until a patch is available. Restrict access to the openwsman server to minimize the risk of exploitation. Avoid using the openwsman server until the issue is resolved.