Discourse vulnerable to multisite DoS by spamming backups
Résumé
Discourse vulnerable to multisite DoS by spamming backups
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Discourse is an open-source discussion platform. Prior to version 3.0.2 of the stable branch and version 3.1.0.beta3 of the beta and tests-passed branches, a user logged as an administrator can request backups multiple times, which will eat up all the connections to the DB. If this is done on a site using multisite, then it can affect the whole cluster. The vulnerability is patched in version 3.0.2 of the stable branch and version 3.1.0.beta3 of the beta and tests-passed branches. There are no known workarounds.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- web nvd.nist.gov