CVE-2024-11595

A flaw was found in Wireshark's FiveCo RAP dissector. This issue occurs when malformed packets are decoded from a pcap file or the network, causing an infinite loop and excessive consumption of CPU resources, resulting in a denial of service.

This vulnerability will cause a crash in Wireshark with no other security impact. For this reason, this flaw has been rated with a moderate severity.

Additionally, Wireshark as shipped in Red Hat Enterprise Linux 8 and 9 is not affected by this vulnerability because the FiveCo RAP protocol dissector was added in a newer version of Wireshark.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If the FiveCo RAP protocol dissector is not being used, it can be disabled via the "Enabled Protocols" dialog box in the Wireshark GUI application. This will also disable the protocol dissector when using "tshark", the command line tool.

See the links below for instructions to disable a protocol in Wireshark, specifically the "Control Protocol Dissection" section and the "disabled_protos" configuration file option.

https://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html https://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html