OpenBMC Project vulnerabilities
We track 3 vulnerabilities in OpenBMC Project products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 31, 2024.
Latest OpenBMC Project vulnerabilities
- 9.8 Critical severity
slpd-lite: Buffer Copy without Checking Size of Input
slpd-lite is a unicast SLP UDP server. Any OpenBMC system that includes the slpd-lite package is impacted. Installing this package is the default when building OpenBMC. Nefarious users can send slp packets to the BMC using UDP port 427 to cause memory overflow
- 7.5 High severity
OpenBMC: Out-of-bounds Write
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memor
- 7.5 High severity
OpenBMC: Out-of-bounds Write
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser han