Please carefully read this notification. It provides a brief description of the security vulnerability, potential impact, important links to Update details and additional information. 

If you are using the WEB transport in PASOE, there is a security vulnerability. All OpenEdge releases are impacted up to and including OpenEdge 11.7.17, 12.2.12, 12.7. 

The recommended action from Progress is to upgrade your application to the latest version of an Active OpenEdge release and then apply the provided Updates as follows.  
 

Vulnerable Version	Fixed Version
OpenEdge Release 11.7.17 and earlier	OpenEdge LTS Update 11.7.18
OpenEdge Releases 12.2.12 and earlier	OpenEdge LTS Update 12.2.13
OpenEdge Innovation Release 12.7 and earlier	OpenEdge LTS 12.8.0

 

If you are running an OpenEdge version that is Retired as described in the OpenEdge Life Cycle, it is necessary to upgrade to one of the Active OpenEdge releases listed above.  

There are no mitigations for this vulnerability.  It is highly recommended that customers follow the recommended steps above to avoid the risks of Denial of Service (DoS) attack associated with this vulnerability.   

 

Security Issue and Potential Impact: 

Please review the public information associated with this security vulnerability provided by the National Vulnerability Database located at CVE-2023-40052. 
 

The WEB transport in PASOE processes URL requests based on a set of parsing rules defined by the multipart/form (RFC 2388 and RFC 2046) specifications. Certain malformed messages or bad requests received by the PASOE web transport can cause PASOE agents to crash due to unexpected syntax that does not conform to the standard. This is a specific type of DoS attack associated with buffer overflow conditions. If malformed information in a URL request is not handled properly by a PASOE agent, it can lead to a denial of service for multi-threaded connections associated with that agent. 

Business Impact: 

An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests. Once the server device is flooded with requests it cannot process, a Distributed Denial of Service (DDoS) attack could leave most users cut off from the PASOE server indefinitely while overwhelmed in its ability to process requested services. 

Resolution: 

An Update is available in OpenEdge 11.7.18, 12.2.13 or 12.8.0. Click here for instructions on how to download your product software and license file. Customers who are not on a current Service Agreement should contact your OpenEdge account representative. 

Use the instructions here to view the version of OpenEdge running on your system. 

Temporary Mitigation Steps: 

If the PASOE web transport is active, this attack is possible.  There are no mitigations for this vulnerability other than turning off the PASOE web transport in your PASOE instance. 

If you have any questions, concerns, or problems related to this issue, please login to open a new Technical Support case here for assistance or reach out to your application provider. Technical Support is available to OpenEdge customers under warranty and an active Service Agreement. 

We want to stress that security is of the utmost importance to us. Progress leverages development practices to minimize product vulnerabilities and we take prompt action to notify you of potential risks. We sincerely apologize for any inconvenience this situation may cause you. 

  

Sincerely,  

The Progress OpenEdge Team