|
|
| Reporter | PDStig | Assigned To | PDStig | |
|---|
| Priority | normal | Severity | Security-hole | |
|---|
| Status | resolved | Resolution | fixed | |
|---|
| Product Version | 11.alpha2 | |
|---|
|
|
| Summary | 5737: DOS loop attack vulnerability in sources/http.php |
|---|
| Description | The file sources/http.php had a DOS loop attack prevention mechanism that was ineffective, leaving the HttpDownloader vulnerable to DOS loop attacks.
The mechanism was to set the internal ua to Composr-recurse so that if the user agent ever came back as such, HttpDownloader would exit. However, Composr-recurse was being set on an unused local variable instead of the class' actual user agent (ua) variable. This made the prevention ineffective.
The git commit commented below contains a hotfix. |
|---|
| Tags | No tags attached. |
|---|
| Attach Tags |
|
|---|
|
|
| Time estimation (hours) | |
|---|
| Sponsorship open | |
|---|
|
|
