PT-2018-11244 · Eclipse · Eclipse Vert.X

Vietj

·

Publicado

2018-10-10

·

Atualizado

2022-04-19

·

CVE-2018-12541

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 3.0.0 through 3.5.3
Description The WebSocket HTTP upgrade implementation in Eclipse Vert.x buffers the full HTTP request before doing the handshake, holding the entire request body in memory. It is recommended to have a reasonable limit, above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed. The suggested limit is 8192 bytes.
Recommendations For Eclipse Vert.x versions 3.0.0 through 3.5.3, consider implementing a limit on the HTTP request body size to prevent excessive memory usage, and return an HTTP response with the 413 status code when this limit is exceeded.

Correção

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-789CWE-119

Identificadores relacionados

CVE-2018-12541
GHSA-45XM-V8GQ-7JQX

Produtos afetados

Eclipse Vert.X