| Name | CVE-2024-4227 |
| Description | In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID attributes which can lead to a DoS. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| gsoap (PTS) | bullseye | 2.8.104-3 | vulnerable |
| bookworm | 2.8.124-2 | vulnerable |
| forky, sid, trixie | 2.8.135-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| gsoap | source | (unstable) | 2.8.135-1 | | | |
Notes
[bookworm] - gsoap <no-dsa> (Minor issue)
[bullseye] - gsoap <postponed> (Minor issue)
https://www.genivia.com/advisory.html#Upgrade_recommendation_when_option_-c++11_is_used_to_generate_C++11_source_code
https://www.genivia.com/changelog.html#Version_2.8.133_(03/21/2024)
Fixed by: https://sourceforge.net/p/gsoap2/code/222/