medium4.5
CVE-2023-50248
Out of memory error when submitting the dataset form with a specially-crafted field
Impact
### Impact When submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create or edit datasets. ### Patches This vulnerability has been patched in CKAN 2.10.3 and 2.9.10
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | ckan | >= 2.0, < 2.9.10 | 2.9.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Okfn | Ckan | from 2.0 before 2.9.10 from 2.10.0 before 2.10.3 |