CVE-2023-4512: 
Wireshark vulnerability analysis and mitigation

CVE-2023-4512 is a vulnerability discovered in Wireshark versions 4.0.0 to 4.0.6 affecting the CBOR (Concise Binary Object Representation) dissector. The vulnerability was discovered by Simone Di Maria and disclosed on August 23, 2023. It affects the network traffic analyzer's ability to process CBOR protocol data, potentially leading to a denial of service condition (Wireshark Advisory, NVD).

The vulnerability stems from an Uncontrolled Recursion (CWE-674) issue in the CBOR dissector, specifically in the dissectcborbytestring() and dissectcbortextstring() functions within the epan/dissectors/packet-cbor.c file. The issue occurs when processing CBOR byte string elements of indefinite length, where the lack of a recursion limit can lead to a stack overflow. The CVSS v3.1 base score is 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (GitLab Issue, NVD).

The vulnerability can result in a denial of service condition through application crashes. An attacker can trigger this by either injecting malformed packets into the network or by convincing a user to open a specially crafted capture file (Wireshark Advisory).

The vulnerability has been fixed in Wireshark version 4.0.8. Users are advised to upgrade to this or later versions to mitigate the risk. The fix implements proper recursion limits to prevent the stack overflow condition (Wireshark Advisory, Fedora Update).