Lucene search

K

Veracode Vulnerability DatabaseVERACODE:21575

HistorySep 26, 2019 - 1:19 a.m.

Denial Of Service (DoS)

2019-09-2601:19:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

11

0.001 Low

EPSS

Percentile

47.2%

Rubyzip is vulnerable to denial of service (DoS) attacks. The zip file entry extract method does not check or limit the file size at the time of extraction, allowing attackers to provide malicious ZIP file entries (aka) ZIP Bomb with spoofed uncompressed sizes to consume disk space at the time of extraction.

CPENameOperatorVersion
rubyziple1.2.4

References

github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e

github.com/rubyzip/rubyzip/pull/403

lists.fedoraproject.org/archives/list/[email protected]/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/

lists.fedoraproject.org/archives/list/[email protected]/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC/

lists.fedoraproject.org/archives/list/[email protected]/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X/

0.001 Low

EPSS

Percentile

47.2%

Related for VERACODE:21575

fedora3 redhatcve1 ubuntucve1 nvd1 osv2 prion1 nessus4 cvelist1 openvas3 redhat1 github1 cve1 debiancve1 ibm1 freebsd1