5310 matches found
AZL-13651 CVE-2023-23916 affecting package cmake for versions less than 3.21.4-13
An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...
AZL-13657 CVE-2023-23916 affecting package mysql for versions less than 8.0.33-1
An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...
AZL-13653 CVE-2023-23916 affecting package curl for versions less than 7.88.1-1
An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...
AZL-13658 CVE-2023-23916 affecting package rust for versions less than 1.72.0-2
An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...
DEBIAN-CVE-2023-23916
An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...
ALPINE-CVE-2023-23916
An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...
AZL-34602 CVE-2023-23916 affecting package cmake for versions less than 3.28.2-1
An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...
CVE-2023-23916
An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...
grok:grk_decompress_fuzzer: Use-of-uninitialized-value in grk::N_AVX2::DecompressDcShiftIrrev::transform
Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=4556232601501696 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id...
CVE-2023-23916
An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...
CVE-2023-23916
CVE-2023-23916 involves curl before 7.88.0 where an attacker could abuse the chained HTTP compression chain to create a degenerate decompression path. Although the cap on the number of links is per header, a malicious server can inject many headers to form an effectively unlimited decompression c...
K16866: PowerDNS vulnerabilities CVE-2014-8601 and CVE-2015-1868
Security Advisory Description CVE-2014-8601 PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service "performance degradations" via a large or infinite number of referrals, as demonstrated by resolving domains hosted by ezdns.it...
Go-Getter Vulnerable to Decompression Bombs
...
GO-2023-1578 Denial of service in github.com/hashicorp/go-getter/v2
HashiCorp go-getter is vulnerable to decompression bombs. This can lead to excessive memory consumption and denial-of-service attacks...
Data Amplification in HashiCorp go-getter
HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0...
GHSA-JPXJ-2JVG-6JV9 Data Amplification in HashiCorp go-getter
HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0...
CVE-2023-0821 Nomad Client Vulnerable to Decompression Bombs in Artifact Block
HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4...
CVE-2023-0821 Nomad Client Vulnerable to Decompression Bombs in Artifact Block
HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4...
Nomad Client Vulnerable to Decompression Bombs in Artifact Block
Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a job submitted with a maliciously compressed source a.k.a “Zip Bomb” in an artifact stanza can cause excessive disk resource consumption, crashing a Nomad client agent. This vulnerability, CVE-2023-0821, was...