Description
Monit 1.4 to 4.1 allows remote attackers to cause a denial of service (daemon crash) via an HTTP POST request with a negative Content-Length field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | monit | 1:4.2.1-1 | — |
| Debian 13 | monit | 1:4.2.1-1 | — |
| Debian 12 | monit | 1:4.2.1-1 | — |
References
- http://www.tildeslash.com/monit/dist/CHANGES.txt
- 9098 vdb-entry
- monit-negative-content-dos(13818) vdb-entry
- GLSA-200403-14 vendor-advisory
- VU#206382 third-party-advisory
- 10280 third-party-advisory
- 20031124 Monit 4.1 HTTP interface multiple security vulnerabilities mailing-list