Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01bXFqLXhjNDktMjQ2cM4AAyO-

crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb

Our use of flate.NewReader does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process.

Permalink: https://github.com/advisories/GHSA-5mqj-xc49-246p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01bXFqLXhjNDktMjQ2cM4AAyO-
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-5mqj-xc49-246p, CVE-2023-28119
References:

• https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p
• https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021
• https://nvd.nist.gov/vuln/detail/CVE-2023-28119
• https://github.com/advisories/GHSA-5mqj-xc49-246p

Repository: https://github.com/crewjam/saml
Blast Radius: 21.4

Affected Packages