CVE-2022-25897

Опубликовано: 08 сент. 2022

Источник: nvd

CVSS3: 5.9

CVSS3: 7.5

EPSS Низкий

Описание

The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

Ссылки

https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
Patch
Third Party Advisory
https://github.com/eclipse/milo/issues/1030
Issue Tracking
Patch
Third Party Advisory
https://github.com/eclipse/milo/pull/1031
Patch
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191
Third Party Advisory
https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
Patch
Third Party Advisory
https://github.com/eclipse/milo/issues/1030
Issue Tracking
Patch
Third Party Advisory
https://github.com/eclipse/milo/pull/1031
Patch
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*

Версия до 0.6.8 (исключая)

EPSS

Процентиль: 55%

0.00331

Низкий

5.9 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-770

Связанные уязвимости

CVE-2022-25897

CVSS3: 7.5

redhat

больше 3 лет назад

GHSA-fph9-f5r6-vhqf

CVSS3: 7.5

github

больше 3 лет назад

Eclipse Milo vulnerable to Resource Exhaustion (Denial of Service)

EPSS

Процентиль: 55%

0.00331

Низкий

5.9 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-770