PT-2014-5154 · Soappy · Soappy

Published 2014-05-12 · Updated 2022-05-17 · CVE-2014-3243

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions SOAPpy version 0.12.5

Description The issue allows remote attackers to cause a denial of service due to memory and CPU consumption. This is achieved through a crafted SOAP request containing a large number of nested entity references, which the software does not properly detect during entity expansion.

Recommendations For SOAPpy version 0.12.5, consider restricting the size and complexity of incoming SOAP requests to prevent excessive resource consumption until a patch is available. As a temporary workaround, limiting the number of nested entity references that can be processed may help mitigate the risk of denial of service attacks.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-3243

GHSA-2GH8-GR6X-7Q26

Affected Products

Soappy

References · 15

• 🔥 http://pnigos.com/?p=260 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3243 · Security Note
• https://ubuntu.com/security/CVE-2014-3243 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3243 · Security Note
• https://osv.dev/vulnerability/GHSA-2gh8-gr6x-7q26 · Vendor Advisory
• https://github.com/kiorky/SOAPpy/commit/64125a24aad228761f38312d44bde4bec7354276 · Note
• https://github.com/kiorky/SOAPpy/commit/a38656817c8ce7d02e117b1308328419a5d1560f · Note
• https://github.com/kiorky/SOAPpy/blob/develop/CHANGES.txt#L32-L37 · Note
• http://seclists.org/fulldisclosure/2014/May/20 · Note
• http://openwall.com/lists/oss-security/2014/05/06/1 · Note
• https://web.archive.org/web/20150501220613/http://pnigos.com/?p=260 · Note
• http://openwall.com/lists/oss-security/2014/05/06/9 · Note
• https://web.archive.org/web/20200229062311/http://securityfocus.com/bid/67216 · Note
• http://securityfocus.com/bid/67216 · Note