Skip to content

Denial Of Service Via Deflate Decompression Bomb

Moderate
crewjam published GHSA-5mqj-xc49-246p Mar 22, 2023

Package

gomod crewjam/saml (Go)

Affected versions

0.4.12

Patched versions

0.4.13

Description

Our use of flate.NewReader does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process.

Severity

Moderate
5.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE ID

CVE-2023-28119

Weaknesses

No CWEs

Credits