Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The HTTP Gateway processes headers, but with no timeout set. With a Slowloris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patches Patch has been implemented by commit 1385bd8 and shipped in v0.1.4. Workarounds No workaround exist. References N/A
Recommended action: Upgrade to 0.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patches Patch has been implemented by commit 14042aa and shipped in v0.1.4. Workarounds No workaround exist. References N/A.
Recommended action: Upgrade to 0.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patches Patch has been implemented by commit 47d188f and shipped in v0.1.4. Workarounds No workaround exist. References N/A.
Recommended action: Upgrade to 0.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.