CVE-2023-45232
7.5
HIGH
CVSS 3.1
EPSS 0.46%
Description
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
How to fix CVE-2023-45232
To remediate CVE-2023-45232, upgrade the affected package to a fixed version below.
- Debian/edk2—upgrade to 2020.11-2+deb11u3 or later
Is CVE-2023-45232 being exploited?
Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 2020.11-2+deb11u3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |