{"id":"CVE-2023-40533","aliases":["EUVD-2023-45104","GHSA-qc4p-7g72-jqrq","UBUNTU-CVE-2023-40533","openSUSE-SU-2024:0119-1"],"status":"rejected","title":"An uninitialized memory use vulnerability exists in Tinyproxy 1.11.1 while parsing HTTP requests....","description":"This CVE ID is a duplicate of CVE-2022-40468","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-457"],"published":"2024-05-01T15:31:00Z","modified":"2026-02-04T03:33:29Z","affected":[{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp155.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp155.3.3.1"}]}],"bundled":5}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40533"},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2023-1902","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/07/1"},{"url":"https://github.com/advisories/GHSA-qc4p-7g72-jqrq"},{"url":"https://ubuntu.com/security/CVE-2023-40533","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40533","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200028","tags":["report"]},{"url":"https://bugzilla.suse.com/1203553","tags":["report"]},{"url":"https://bugzilla.suse.com/1223743","tags":["report"]},{"url":"https://bugzilla.suse.com/1223746","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49606","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-40533","description":"This CVE ID is a duplicate of CVE-2022-40468\n","status":"rejected","published":"2024-05-01T15:31:00.893Z","modified":"2024-05-08T21:49:47.414Z","updated_at":"2026-11-02T14:35:21.971258Z"}],"euvd":[{"id":"EUVD-2023-45104","description":"This CVE ID is a duplicate of CVE-2022-40468\n","status":"published","published":"2024-05-01T15:31:00Z","modified":"2024-05-08T21:49:47Z","updated_at":"2026-11-03T03:50:51.128689Z"}],"ghsa":[{"id":"GHSA-qc4p-7g72-jqrq","title":"An uninitialized memory use vulnerability exists in Tinyproxy 1.11.1 while parsing HTTP requests....","description":"An uninitialized memory use vulnerability exists in Tinyproxy 1.11.1 while parsing HTTP requests. In certain configurations, a specially crafted HTTP request can result in disclosure of data allocated on the heap, which could contain sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.","status":"published","published":"2024-05-01T18:30:40Z","modified":"2024-05-07T12:30:50Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-457"],"updated_at":"2026-11-02T14:57:20.289371Z"}],"nvd":[{"id":"CVE-2023-40533","description":"Rejected reason: This CVE ID is a duplicate of CVE-2022-40468\n","status":"rejected","published":"2024-05-01T16:15:06.59Z","modified":"2024-05-08T22:15:47.727Z","updated_at":"2026-11-02T14:09:11.362739Z"}],"osv":[{"id":"UBUNTU-CVE-2023-40533","description":"** REJECT ** This CVE ID is a duplicate of CVE-2022-40468","status":"withdrawn","published":"2024-05-01T16:15:00Z","modified":"2025-07-08T14:32:27.735276Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"openSUSE-SU-2024:0119-1","title":"Security update for tinyproxy","description":"This update for tinyproxy fixes the following issues:\n\n- Update to release 1.11.2\n  * Fix potential use-after-free in header handling [CVE-2023-49606, boo#1223746]\n  * Prevent junk from showing up in error page in invalid requests [CVE-2022-40468, CVE-2023-40533, boo#1223743]\n\n- Move tinyproxy program to /usr/bin.\n\n- Update to release 1.11.1\n  * New fnmatch based filtertype\n\n- Update to release 1.11\n  * Support for multiple bind directives.\n\n- update to 1.10.0:\n  * Configuration file has moved from /etc/tinyproxy.conf to\n    /etc/tinyproxy/tinyproxy.conf.\n  * Add support for basic HTTP authentication\n  * Add socks upstream support\n  * Log to stdout if no logfile is specified\n  * Activate reverse proxy by default\n  * Support bind with transparent mode\n  * Allow multiple listen statements in the configuration\n  * Fix CVE-2017-11747: Create PID file before dropping privileges.\n  * Fix CVE-2012-3505: algorithmic complexity DoS in hashmap\n  * Bugfixes\n  * BB#110: fix algorithmic complexity DoS in hashmap\n  * BB#106: fix CONNECT requests with IPv6 literal addresses as host\n  * BB#116: fix invalid free for GET requests to ipv6 literal address\n  * BB#115: Drop supplementary groups\n  * BB#109: Fix crash (infinite loop) when writing to log file fails\n  * BB#74: Create log and pid files after we drop privs\n  * BB#83: Use output of id instead of $USER\n","status":"published","published":"2024-05-10T12:42:27Z","modified":"2026-02-04T03:33:29.462336Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}