PT-2023-21576 · Saml+1 · Saml+1

Nszetei · Published 2023-03-22 · Updated 2023-08-23 · CVE-2023-28119

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions github.com/crewjam/saml versions prior to 0.4.13

Description The issue arises from the package's use of flate.NewReader without limiting the size of the input. This allows a user to pass more than 1 MB of data in an HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Repeating the same request multiple times can lead to a reliable crash, as the operating system kills the process due to excessive resource usage.

Recommendations For versions prior to 0.4.13, update to version 0.4.13 to resolve the issue. As a temporary workaround, consider limiting the size of HTTP requests to prevent excessive decompression. Restrict access to the flate.NewReader function until a patch is available. Avoid using the Deflate algorithm for decompressing large inputs in the affected API endpoints until the issue is resolved.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2023-4133

ALT-PU-2023-4148

ALT-PU-2023-4346

ALT-PU-2023-4567

CVE-2023-28119

GHSA-5MQJ-XC49-246P

GO-2023-1664

Affected Products

Alt Linux

Saml

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28119.json · Exploit
• https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p · Vendor Advisory
• https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28119 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5mqj-xc49-246p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28119 · Security Note
• https://osv.dev/vulnerability/GO-2023-1664 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28119 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-28119 · Security Note
• https://github.com/crewjam/saml · Note
• https://t.me/cvenotify/46680 · Telegram Post
• https://t.me/cvenotify/47022 · Telegram Post
• https://t.me/cibsecurity/60531 · Telegram Post
• https://t.me/cvenotify/46696 · Telegram Post