PT-2014-5154 · Soappy · Soappy

Publicado 2014-05-12 · Atualizado 2022-05-17 · CVE-2014-3243

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions SOAPpy version 0.12.5

Description The issue allows remote attackers to cause a denial of service due to memory and CPU consumption. This is achieved through a crafted SOAP request containing a large number of nested entity references, which the software does not properly detect during entity expansion.

Recommendations For SOAPpy version 0.12.5, consider restricting the size and complexity of incoming SOAP requests to prevent excessive resource consumption until a patch is available. As a temporary workaround, limiting the number of nested entity references that can be processed may help mitigate the risk of denial of service attacks.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2014-3243

GHSA-2GH8-GR6X-7Q26

Produtos afetados

Soappy

Referências · 15

• 🔥 http://pnigos.com/?p=260 · Exploit
• https://github.com/kiorky/SOAPpy/commit/64125a24aad228761f38312d44bde4bec7354276 · Nota
• https://github.com/kiorky/SOAPpy/commit/a38656817c8ce7d02e117b1308328419a5d1560f · Nota
• https://github.com/kiorky/SOAPpy/blob/develop/CHANGES.txt#L32-L37 · Nota
• http://seclists.org/fulldisclosure/2014/May/20 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3243 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/05/06/1 · Nota
• https://web.archive.org/web/20150501220613/http://pnigos.com/?p=260 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3243 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/05/06/9 · Nota
• https://ubuntu.com/security/CVE-2014-3243 · Aviso do Fabricante
• https://web.archive.org/web/20200229062311/http://securityfocus.com/bid/67216 · Nota
• http://securityfocus.com/bid/67216 · Nota
• https://cve.org/CVERecord?id=CVE-2014-3243 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-2gh8-gr6x-7q26 · Aviso do Fabricante