CVE-2022-27897 Palantir Gotham included an endpoint that would log arbitrary sized zip files.
An unauthenticated endpoint in Palantir Gotham allows attackers to exhaust server memory by uploading malicious zip files, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27897?
CVE-2022-27897 is a medium-severity denial of service vulnerability in Palantir Gotham, published on 16 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server.
Weakness: CWE-20
Which versions are affected by CVE-2022-27897?
It affects 1 product.
Products include Palantir Gotham.
How do I fix CVE-2022-27897?
No fix has been published for CVE-2022-27897 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-27897 being exploited?
There is no known exploitation of CVE-2022-27897 in the wild and no public exploit code.
Other vulnerabilities in Palantir Gotham
Sources
Also known as GHSA-fcgx-8f7g-hw7g.