Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-j7jw-28jm-whr6

Опубликовано: 21 фев. 2025
Источник: github
Github: Прошло ревью
CVSS3: 6.5

Описание

lakeFS allows an authenticated user to cause a crash by exhausting server memory

Impact

An authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue.

Patches

This problem has been patched and exists in versions 1.49.1 and below

Workarounds

On S3 backends, configure

# ... blockstore: s3: disable_pre_signed_multipart: true

or set environment variable LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART to true.

References

Are there any links users can visit to find out more?

Пакеты

Наименование

github.com/treeverse/lakefs

go
Затронутые версииВерсия исправления

< 1.50.0

1.50.0

EPSS

Процентиль: 20%
0.00063
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-400

Связанные уязвимости

CVSS3: 6.5
nvd
12 месяцев назад

lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable `LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART` to `true` or configure the `disable_pre_signed_multipart` key to true in their config yaml.

EPSS

Процентиль: 20%
0.00063
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-400