Asymmetric denial of service In github.com/crewjam/saml
Description
crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb Our use of flate.NewReader does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 go | 0.4.13 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.