CVE-2024-3508
Assigner: redhat
Published: 2024-04-25T17:46:21.762Z
State: PUBLISHED
title: Bzip2: compressed content bomb leads to denial of service of bombastic api
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
format: CVSS
descriptions: value: A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.
affected: vendor: Red Hat
product: Red Hat Trusted Profile Analyzer
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: SBOM-Management-(Bombastic)
defaultStatus: affected
cpes: cpe:/a:redhat:trusted_profile_analyzer:1
datePublic: 2024-04-09T00:00:00+00:00
timeline: time: 2024-04-09T00:00:00+00:00
value: Reported to Red Hat.
time: 2024-04-09T00:00:00+00:00
value: Made public.