GHSA-v6cj-r88p-92rm Buffer Overflow in centra
An attacker can cause a denial of service by sending large responses to an application using the Centra library, which buffers them without limit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-v6cj-r88p-92rm?
GHSA-v6cj-r88p-92rm is a denial of service vulnerability in centra, published on 30 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Denial of Service
Impact
Affected Centra versions will, when not in stream mode, buffer responses to requests into memory with no size limit. This issue affects anyone requesting content from untrusted sources.
Patches
Version 2.4.0 resolves the issue by limiting the size of buffered response body.
Workarounds
Attempting workarounds isn't recommended. Updating is preferred.
For more information
If you have any questions or comments about this advisory, open an issue in ethanent/centra.
Which versions are affected by GHSA-v6cj-r88p-92rm?
2 open source packages ship an affected version, including centra.
| Package | Affected | Fixed in |
|---|---|---|
centra npm | All versions | 2.4.0 |
centra npm | All versions | 2.4.0 |
How do I fix GHSA-v6cj-r88p-92rm?
Upgrade centra to 2.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-v6cj-r88p-92rm being exploited?
There is no known exploitation of GHSA-v6cj-r88p-92rm in the wild and no public exploit code.