La fiche CVE officielle n’est pas encore publiée
Publié d’après l’avis de l’éditeur. Remplacé par la fiche CVE.org / NVD dès sa publication.
Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
Résumé
Impact
The authenticated POST /messages/render endpoint renders arbitrary user-supplied Markdown but, unlike the message send and edit endpoints, did not enforce Zulip's normal message length limit on its content parameter.
As a result, a single request could supply content up to the serve...
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| Zulip Server |
<= 12.1 |
12.2 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Impact
The authenticated POST /messages/render endpoint renders arbitrary user-supplied Markdown but, unlike the message send and edit endpoints, did not enforce Zulip's normal message length limit on its content parameter.
As a result, a single request could supply content up to the server's body-size limit to be rendered. Processing requests of this size would consume a disproportionate amount of backend CPU, and repeated or concurrent requests from a single authenticated account could degrade Markdown rendering performance or backend availability for other users.
Patches
Fixed in Zulip server 12.2.
Source: GitHub Repository Security Advisories (Game のスタック) NVD GitHub Advisory
Références
- GITHUB_REPO_ADVISORY zulip/zulip