Veracode Vulnerability DatabaseVERACODE:45022Uncontrolled Resource Consumption
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.0%
libspreadsheet-parsexlsx-perl is vulnerable to out-of-memory. The vulnerability is due to there is no constraints on merged cells in its memoize implementation, leading to excessive memory consumption when parsing crafted XLSX documents. This potentially leads to Denial of service.
References
www.openwall.com/lists/oss-security/2024/01/10/2
github.com/haile01/perl_spreadsheet_excel_rce_poc/blob/main/parse_xlsx_bomb.md
lists.debian.org/debian-lts-announce/2024/01/msg00018.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6R7NYWVVZYDZIQC5YEXNHZM6VEE26SJV/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNJVC4C5C5V44DNOZ5BHVU53CDXPB2OJ/
metacpan.org/dist/Spreadsheet-ParseXLSX/changes
security-tracker.debian.org/tracker/CVE-2024-22368
security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.0%