~ / search / GHSA-7fgc-89cx-w8j5

GHSA-7fgc-89cx-w8j5

Out of memory error when submitting the dataset form with a specially-crafted field

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-50248

Packages

EcosystemPackageAffectedFixed in
PyPI ckan >= 2.0, < 2.9.10 2.9.10
PyPI ckan >= 2.10.0, < 2.10.3 2.10.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create or edit datasets. ### Patches This vulnerability has been patched in CKAN 2.10.3 and 2.9.10

References

External links from the advisory. They lead to third-party sites.