CVE-2023-0417: 
Wireshark vulnerability analysis and mitigation

Memory leak in the NFS dissector in Wireshark versions 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 that allows denial of service via packet injection or crafted capture file. The vulnerability was discovered in January 2023 and is tracked as CVE-2023-0417 (Wireshark Advisory, NVD).

The vulnerability is classified as CWE-404 (Improper Resource Shutdown or Release) and received a CVSS v3.1 base score of 6.5 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) from NVD, while GitLab Inc. assessed it at 6.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The issue specifically affects the Network File System (NFS) dissector component of Wireshark (NVD).

The vulnerability allows attackers to cause denial of service conditions by making Wireshark consume excessive CPU resources. This can be achieved either through packet injection on a network or by convincing a user to open a malformed packet trace file (Wireshark Advisory).

The vulnerability has been fixed in Wireshark versions 4.0.3 and 3.6.11. Users are advised to upgrade to these or later versions to mitigate the risk. For Debian 10 (buster) users, the fix is available in version 2.6.20-0+deb10u5 (Debian Advisory, Wireshark Advisory).