Описание
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.
Отчет
This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.
Меры по смягчению последствий
To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | rhai/assisted-installer-rhel9 | Affected | ||
| Builds for Red Hat OpenShift | openshift-builds/openshift-builds-waiters-rhel9 | Affected | ||
| cert-manager Operator for Red Hat OpenShift | cert-manager/jetstack-cert-manager-rhel9 | Affected | ||
| Compliance Operator | compliance/openshift-compliance-operator-bundle | Affected | ||
| Confidential Compute Attestation | build-of-trustee/trustee-rhel9-operator | Affected | ||
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-monitor-rhel9 | Affected | ||
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Affected | ||
| Deployment Validation Operator | dvo/deployment-validation-rhel8-operator | Affected | ||
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-rhel9 | Will not fix | ||
| File Integrity Operator | compliance/openshift-compliance-operator-bundle | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Quadratic complexity in WordDecoder.DecodeHeader in mime
Decoding a maliciously-crafted MIME header containing many invalid enc ...
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
EPSS
7.5 High
CVSS3