A ready-made attack for a flaw in Tinyproxy is now public
KROMSE explanation
Tinyproxy has a security flaw (CVE-2023-49606, CVSS 9.8). The official record says: A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution.
Not confirmed yet, but attack code is public, so attacks often follow within days.
Anyone running Tinyproxy.
- Install the maker's update for Tinyproxy as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
