Описание
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libsoup3 | unfixed | package | ||
| libsoup3 | no-dsa | bookworm | package | |
| libsoup2.4 | unfixed | package | ||
| libsoup2.4 | no-dsa | bookworm | package |
Примечания
https://gitlab.gnome.org/GNOME/libsoup/-/issues/428
See also https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452
Upstream also claims there are multiple worse DoS problems, so questions the usefulness of this fix.
EPSS
Связанные уязвимости
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory.
Уязвимость библиотеки libsoup графического интерфейса GNOME, связанная с асимметричным потреблением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
EPSS