GHSA-g43w-98wp-m694medium5.3No CVE assigned
SilverStripe framework XML Quadratic Blowup Attack
Impact
A low level vulnerability has been found in the SilverStripe framework, where the Quadratic Blowup Attack could potentially be exploited to affect the performance of a site.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
silverstripe/framework Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 3.1.12Ecosystem versions | 3.1.12 |
Version evidence: OSV · GHSA-g43w-98wp-m694
View original version evidence (58 explicit versions)
Original source description
A low level vulnerability has been found in the SilverStripe framework, where the Quadratic Blowup Attack could potentially be exploited to affect the performance of a site.
See http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/ for a writeup.
References
- Patch github.com/silverstripe/silverstripe-framework/commit/7f983c2bae1dc78ca7217e9af364b2fb71dcefe8
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2014-017-1.yaml
- Source reference github.com/silverstripe/silverstripe-framework
- Security advisory www.silverstripe.org/software/download/security-releases/ss-2014-017-xml-quadratic-blowup-attack