GitHub Advisoryadvisory · PyPI

GHSA-7fgc-89cx-w8j5 Out of memory error when submitting the dataset form with a specially-crafted field

MEDIUM Published 2023-12-13 Modified 2023-12-13 Official page ↗
Aliases
CVE-2023-50248
Ecosystem
PyPI
Packages
ckan
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-130
Reviewed
2023-12-13

Affected packages

• PyPI ckan: >= 2.0, < 2.9.10 → fixed in 2.9.10 • PyPI ckan: >= 2.10.0, < 2.10.3 → fixed in 2.10.3

Description

Impact When submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create or edit datasets. Patches This vulnerability has been patched in CKAN 2.10.3 and 2.9.10

Related

Alias · CVE (1)

  • CVE-2023-50248 CKAN is an open-source data management system for powering data hubs and data portals. vulnerability

Weakness · CWE (1)

  • CWE-130 Improper Handling of Length Parameter Inconsistency weakness

References