[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAGSZ4d6LBTEQyr_qB5xHEkhv83DL42Pysgh6BNBoJSouvshAiw@mail.gmail.com>
Date: Wed, 4 Dec 2019 06:27:11 +0100
From: mibo <mibo@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2019-17555: Olingo: DoS via Retry-After header vulnerability
CVE-2019-17555: DoS via Retry-After header vulnerability
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Olingo 4.0.0 to 4.6.0
The OData v2 versions of Olingo 2.x are not affected
Description:
The AsyncResponseWrapperImpl class reads the Retry-After header and
passes it to the Thread.sleep() method without any check. If a
malicious server returns a huge value in the header, then it can help
to implement a DoS attack.
Mitigation:
4.x.x users should upgrade to 4.7.0
Credit:
This issue was discovered by Artem Smotrakov of SAP SE.
Links:
https://issues.apache.org/jira/browse/OLINGO-1411
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
