ethanent/centra · Security
Buffer Overflow in centra
- GHSA ID
- GHSA-v6cj-r88p-92rm
- Severity
- high
- Published
- Updated
- CVSS
- 7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Description
Denial of Service
Impact
Affected Centra versions will, when not in stream mode, buffer responses to requests into memory with no size limit. This issue affects anyone requesting content from untrusted sources.
Patches
Version 2.4.0 resolves the issue by limiting the size of buffered response body.
Workarounds
Attempting workarounds isn't recommended. Updating is preferred.
For more information
If you have any questions or comments about this advisory, open an issue in ethanent/centra.
CWEs
- CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer