CVE-2024-23952
Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)
| Assigner | apache |
| Reserved | 2024-01-24 |
| Published | 2024-02-14 |
| Updated | 2024-08-14 |
This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Dor Konis – GE Vernova
https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksx
http://www.openwall.com/lists/oss-security/2024/02/14/2
http://www.openwall.com/lists/oss-security/2024/02/14/3
