PT-2023-31506 · Ckan · Ckan

Thorge · Published 2023-12-13 · Updated 2023-12-18 · CVE-2023-50248

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CKAN versions 2.0.0 through 2.9.9 CKAN versions 2.10.0 through 2.10.2

Description CKAN is an open-source data management system for powering data hubs and data portals. When submitting a POST request to the "/dataset/new" endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker needs to have permissions to create or edit datasets.

Recommendations For CKAN versions 2.0.0 through 2.9.9, update to version 2.9.10 or later. For CKAN versions 2.10.0 through 2.10.2, update to version 2.10.3 or later. As a temporary workaround, consider restricting access to the "/dataset/new" endpoint for users with permissions to create or edit datasets until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-130

Related Identifiers

CVE-2023-50248

GHSA-7FGC-89CX-W8J5

Affected Products

Ckan

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50248.json · Exploit
• https://github.com/ckan/ckan/security/advisories/GHSA-7fgc-89cx-w8j5 · Vendor Advisory
• https://github.com/ckan/ckan/commit/bd02018b65c5b81d7ede195d00d0fcbac3aa33be · Patch
• https://osv.dev/vulnerability/CVE-2023-50248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50248 · Security Note
• https://osv.dev/vulnerability/GHSA-7fgc-89cx-w8j5 · Vendor Advisory
• https://github.com/ckan/ckan · Note
• https://twitter.com/VulmonFeeds/status/1735086842058359175 · Twitter Post
• https://twitter.com/CVEnew/status/1735045563010404375 · Twitter Post
• https://t.me/cvenotify/64006 · Telegram Post