CVE-2021-32848 Octobox ReDoS vulnerability
Attackers can cause denial of service in Octobox by submitting crafted search queries that trigger excessive resource consumption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32848?
CVE-2021-32848 is a high-severity denial of service vulnerability in octobox, published on 20 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query string that will trigger a ReDoS vulnerability. This issue is fixed in PR 2807.
Which versions are affected by CVE-2021-32848?
It affects 1 product.
Products include Octobox Project Octobox.
How do I fix CVE-2021-32848?
No fix has been published for CVE-2021-32848 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-32848 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-32848 exists.
Sources
Also known as GHSA-q567-jfmr-4rr7.