Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14eGMyLWo3amotNmc1bc4AAtzF

Raneto Denial of Service via crafted payload injected into `Search` parameter

An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.

Permalink: https://github.com/advisories/GHSA-xxc2-j7jj-6g5m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14eGMyLWo3amotNmc1bc4AAtzF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-xxc2-j7jj-6g5m, CVE-2022-35142
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-35142
• https://cwe.mitre.org/data/definitions/703.html
• https://gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144/
• https://github.com/gilbitron/Raneto/releases
• http://raneto.com/
• https://github.com/ryanlelek/Raneto/issues/368
• https://github.com/ryanlelek/Raneto/pull/370
• https://github.com/ryanlelek/Raneto/releases/tag/0.17.1
• https://github.com/advisories/GHSA-xxc2-j7jj-6g5m

Repository: https://github.com/gilbitron/Raneto
Blast Radius: 8.1

Affected Packages