Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yMnBnLXc5NnAtcGNwas4AAbfv

ws-xmlrpc DoS Vulnerability

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.

Permalink: https://github.com/advisories/GHSA-r2pg-w96p-pcpj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yMnBnLXc5NnAtcGNwas4AAbfv
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 6.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00218
EPSS Percentile: 0.60514

Identifiers: GHSA-r2pg-w96p-pcpj, CVE-2016-5004
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-5004
• https://github.com/0ang3el/unsafe-xmlrpc
• http://www.openwall.com/lists/oss-security/2016/07/12/5
• https://web.archive.org/web/20160716070844/http://www.securitytracker.com/id/1036294
• https://web.archive.org/web/20171111065719/http://www.securityfocus.com/bid/91736
• https://web.archive.org/web/20171114185236/https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
• https://github.com/advisories/GHSA-r2pg-w96p-pcpj

Repository: https://github.com/0ang3el/unsafe-xmlrpc
Blast Radius: 16.7

Affected Packages