CVE-2018-10864 Denial of service in redhat-certification:
A remote attacker can cause a Denial of Service by providing an invalid XML file that is opened but never closed in the Red Hat certification tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10864?
CVE-2018-10864 is a medium-severity denial of service vulnerability in [UNKNOWN] redhat-certification:, published on 13 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existing but invalid XML file which would be opened and never closed, possibly producing a Denial of Service.
Weakness: CWE-400
Which versions are affected by CVE-2018-10864?
It affects 1 product.
Products include Redhat Certification.
How do I fix CVE-2018-10864?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-10864 being exploited?
There is no known exploitation of CVE-2018-10864 in the wild and no public exploit code.
Other vulnerabilities in [UNKNOWN] redhat-certification:
Sources
Also known as GHSA-3mqx-hc7r-v3c4.