Описание
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.
A flaw was found in t-digest. A remote attacker could exploit a denial of service vulnerability in the MergingDigest.fromBytes function by providing specially crafted serialized data. This data, with unvalidated length and capacity fields, can cause the parsing thread to abort due to an ArrayIndexOutOfBoundsException or NegativeArraySizeException, leading to a denial of service.
Отчет
The MergingDigest.fromBytes() method does not validate length fields in serialized input, allowing an attacker to cause excessive memory allocation or out-of-bounds reads, resulting in a Denial of Service. This is exploitable when deserializing untrusted t-digest data received over the network.
Меры по смягчению последствий
Apply the upstream fix. As a workaround, ensure that t-digest serialized data is only accepted from trusted sources and not exposed to untrusted network input.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | t-digest | Not affected | ||
| Red Hat Offline Knowledge Portal | offline-knowledge-portal/rhokp-rhel9 | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
(t-digest versions 3.1 through 3.3 contain a denial of service vulnerab ...)
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.
EPSS
7.5 High
CVSS3