GHSA-h6rp-mprm-xgcqMediumCVSS 7.5
plone.rest vulnerable to Denial of Service when ++api++ is used many times
🔗 CVE IDs covered (1)
📋 Description
Impact
When the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive.
Patches
Patches will be released in plone.rest 2.0.1 and 3.0.1. Series 1.x is not affected.
Workarounds
In your frontend web server (nginx, Apache) you can redirect /++api++/++api++ to /++api++.
🎯 Affected products2
- pip/plone.rest:>= 2.0.0a1, < 2.0.1
- pip/plone.rest:= 3.0.0
🔗 References (7)
- https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq
- https://nvd.nist.gov/vuln/detail/CVE-2023-42457
- https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7
- https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302
- http://www.openwall.com/lists/oss-security/2023/09/22/2
- https://github.com/pypa/advisory-database/tree/main/vulns/plone-rest/PYSEC-2023-178.yaml
- https://github.com/advisories/GHSA-h6rp-mprm-xgcq