Vulnerability · Published Apr 25, 2024 · Assigned by redhat
CVE-2024-3508Bzip2: compressed content bomb leads to denial of service of bombastic api
Medium 4.3
In plain English
A medium-severity uncontrolled resource consumption in bzip2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.5%top 57.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bzip2 | see references | |
| Red Hat | Red Hat Trusted Profile Analyzer | see references |
Weakness: CWE-400, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://access.redhat.com/security/cve/CVE-2024-3508 vdb-entry, x_refsource_REDHAT
- RHBZ#2274109 issue-tracking, x_refsource_REDHAT