GHSA-jrfj-98qg-qjgv

Denial of service in sidekiq

Source: GitHub Advisory Database (reviewed) High CVE-2022-23837

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	sidekiq	>= 6.0.0, < 6.4.0	6.4.0
RubyGems	sidekiq	< 5.2.10	5.2.10

Details

As written in the advisory (Markdown source, shown as plain text).

In `api.rb` in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23837 advisory
https://github.com/rubysec/ruby-advisory-db/pull/495 web
https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956 web
https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md web
https://github.com/mperham/sidekiq package
https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html web