{"id":"CVE-2023-28488","aliases":["DEBIAN-CVE-2023-28488","DLA-3397-1","DSA-5416-1","EUVD-2023-32158","GHSA-vw29-hgcp-pxgr","MGASA-2023-0167","UBUNTU-CVE-2023-28488","USN-6236-1","openSUSE-SU-2023:0369-1","openSUSE-SU-2023:0370-1","openSUSE-SU-2024:13420-1"],"status":"published","title":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating...","description":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00964,"percentile":0.61923,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-04-12T00:00:00Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Debian:12","package":"connman","fixed_in":["1.41-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"connman","fixed_in":["1.41-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"connman","fixed_in":["1.41-3"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"connman","fixed_in":["1.36-2.1~deb10u5"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"connman","fixed_in":["1.36-2.2+deb11u2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"connman","fixed_in":["1.38-2.4.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"connman","fixed_in":["1.21-1.2+deb8u1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"connman","fixed_in":["1.35-6ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"connman","fixed_in":["1.36-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"connman","fixed_in":["1.36-2.3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"connman","fixed_in":["1.42-bp155.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"connman","fixed_in":["1.42-bp155.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"connman","fixed_in":["1.42-bp154.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"connman","fixed_in":["1.42-bp154.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"connman","fixed_in":["1.42-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41-3"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-2.1~deb10u5"}]}],"versions":["1.36-2","1.36-2.1~deb10u1","1.36-2.1~deb10u2","1.36-2.1~deb10u3","1.36-2.1~deb10u4"]},{"source":"osv","ecosystem":"Debian:11","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-2.2+deb11u2"}]}],"versions":["1.36-2.2","1.36-2.2+deb11u1"]},{"source":"osv","ecosystem":"Mageia:8","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38-2.4.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21-1.2+deb8u1ubuntu0.1~esm1"}]}],"versions":["1.21-1.2","1.21-1.2build1","1.21-1.2build2","1.21-1.2+deb8u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-6ubuntu0.1~esm1"}]}],"versions":["1.35-1","1.35-2","1.35-6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-2ubuntu0.1"}]}],"versions":["1.36-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-2.3ubuntu0.1"}]}],"versions":["1.36-2.2build1","1.36-2.3","1.36-2.3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21-1.2+deb8u1ubuntu0.1~esm1"}]}],"versions":["1.21-1.2","1.21-1.2build1","1.21-1.2build2","1.21-1.2+deb8u1build0.16.04.1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-6ubuntu0.1~esm1"}]}],"versions":["1.35-1","1.35-2","1.35-6"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-2ubuntu0.1"}]}],"versions":["1.36-2build1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-2.3ubuntu0.1"}]}],"versions":["1.36-2.2build1","1.36-2.3","1.36-2.3build1"],"bundled":9},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42-bp155.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42-bp155.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42-bp154.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42-bp154.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42-1.1"}]}]}],"products":[{"vendor":"intel","product":"connman"}],"references":[{"url":"https://kernel.googlesource.com/pub/scm/network/connman/connman/+/99e2c16ea1cced34a5dc450d76287a1c3e762138","tags":["x_transferred","Patch","web","report"]},{"url":"https://github.com/moehw/poc_exploits/tree/master/CVE-2023-28488","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00024.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://www.debian.org/security/2023/dsa-5416","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28488","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vw29-hgcp-pxgr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28488.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28488","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0167.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31878","tags":["report"]},{"url":"https://www.debian.org/lts/security/2023/dla-3397","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-28488","tags":["report"]},{"url":"https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=99e2c16ea1cced34a5dc450d76287a1c3e762138","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6236-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32293","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JE33AUDBYZOO3LHUWP2WCZRW7H3IHMC5/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28488","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BQ4WWEMQKB2CUE5MVMKJC2Q74GJGUDLY/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-28488","description":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.","status":"published","published":"2023-04-12T00:00:00Z","modified":"2025-02-08T02:37:47.578Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-32158","description":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.","status":"published","published":"2023-04-12T00:00:00Z","modified":"2025-02-08T02:37:47Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:01.319038Z"}],"ghsa":[{"id":"GHSA-vw29-hgcp-pxgr","title":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating...","description":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.","status":"published","published":"2023-04-12T18:30:39Z","modified":"2024-04-04T03:25:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:56:14.876837Z"}],"nvd":[{"id":"CVE-2023-28488","description":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.","status":"published","published":"2023-04-12T16:15:19.353Z","modified":"2026-06-17T05:47:51.453Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:55.652109Z"}],"osv":[{"id":"CVE-2023-28488","description":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.","status":"published","published":"2023-04-12T00:00:00Z","modified":"2026-10-28T02:31:13.269700491Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-28488","description":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.","status":"published","published":"2023-04-12T16:15:19.353Z","modified":"2026-10-26T18:01:47.742444964Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-28488","description":"client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.","status":"published","published":"2023-04-12T16:15:00Z","modified":"2026-04-22T14:04:56.945564Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"DLA-3397-1","title":"connman - security update","status":"published","published":"2023-04-21T00:00:00Z","modified":"2026-03-09T01:22:20.029277Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5416-1","title":"connman - security update","status":"published","published":"2023-05-31T00:00:00Z","modified":"2026-03-09T02:08:35.229916Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2023-0167","title":"Updated connman packages fix security vulnerability","description":"client.c in gdhcp in ConnMan could be used by network-adjacent attackers\n(operating a crafted DHCP server) to cause a stack-based buffer overflow\nand denial of service, terminating the connman process. (CVE-2023-28488)\n","status":"published","published":"2023-05-16T19:17:40Z","modified":"2026-04-16T04:42:20.861851123Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0369-1","title":"Security update for connman","description":"This update for connman fixes the following issues:\n\nUpdate to 1.42\n\n  * Fix issue with iwd and signal strength calculation.\n  * Fix issue with iwd and handling service removal.\n  * Fix issue with iwd and handling new connections.\n  * Fix issue with handling default online check URL.\n  * Fix issue with handling nameservers refresh.\n  * Fix issue with handling proxy from DHCP lease. (boo#1210395 CVE-2023-28488)\n  * Fix issue with handling multiple proxies from PAC.\n  * Fix issue with handling manual time update changes.\n  * Fix issue with handling invalid gateway routes.\n  * Fix issue with handling hidden WiFi agent requests.\n  * Fix issue with handling WiFi SAE authentication failure.\n  * Fix issue with handling DNS Proxy and TCP server replies.\n  * Add support for regulatory domain following timezone.\n  * Add support for localtime configuration option.\n","status":"published","published":"2023-11-14T15:14:22Z","modified":"2025-05-07T18:14:51.479784Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0370-1","title":"Security update for connman","description":"This update for connman fixes the following issues:\n\n- Update to 1.42\n\n  * Fix issue with iwd and signal strength calculation.\n  * Fix issue with iwd and handling service removal.\n  * Fix issue with iwd and handling new connections.\n  * Fix issue with handling default online check URL.\n  * Fix issue with handling nameservers refresh.\n  * Fix issue with handling proxy from DHCP lease. (boo#1210395 CVE-2023-28488)\n  * Fix issue with handling multiple proxies from PAC.\n  * Fix issue with handling manual time update changes.\n  * Fix issue with handling invalid gateway routes.\n  * Fix issue with handling hidden WiFi agent requests.\n  * Fix issue with handling WiFi SAE authentication failure.\n  * Fix issue with handling DNS Proxy and TCP server replies.\n  * Add support for regulatory domain following timezone.\n  * Add support for localtime configuration option.\n","status":"published","published":"2023-11-14T15:14:29Z","modified":"2026-02-04T03:35:29.91683Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13420-1","title":"connman-1.42-1.1 on GA media","description":"These are all security issues fixed in the connman-1.42-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:53:30.916878Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"USN-6236-1","title":"connman vulnerabilities","description":"It was discovered that ConnMan could be made to write out of bounds. A\nremote attacker could possibly use this issue to cause ConnMan to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2021-26675, CVE-2021-33833)\n\nIt was discovered that ConnMan could be made to leak sensitive information\nvia the gdhcp component. A remote attacker could possibly use this issue\nto obtain information for further exploitation. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-26676)\n\nIt was discovered that ConnMan could be made to read out of bounds. A\nremote attacker could possibly use this issue to case ConnMan to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2022-23096, CVE-2022-23097)\n\nIt was discovered that ConnMan could be made to run into an infinite loop.\nA remote attacker could possibly use this issue to cause ConnMan to\nconsume resources and to stop operating, resulting in a denial of service.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, and Ubuntu 22.04 LTS. (CVE-2022-23098)\n\nIt was discovered that ConnMan could be made to write out of bounds via\nthe gweb component. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-32292)\n\nIt was discovered that ConnMan did not properly manage memory under\ncertain circumstances. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-32293)\n\nIt was discovered that ConnMan could be made to write out of bounds via\nthe gdhcp component. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2023-28488)\n","status":"published","published":"2023-07-19T08:45:49Z","modified":"2026-06-25T13:32:12.092508863Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}