CVE-2024-4227

NameCVE-2024-4227
DescriptionIn Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID attributes which can lead to a DoS.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gsoap (PTS)bullseye2.8.104-3vulnerable
bookworm2.8.124-2vulnerable
forky, sid, trixie2.8.135-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gsoapsource(unstable)2.8.135-1

Notes

[bookworm] - gsoap <no-dsa> (Minor issue)
[bullseye] - gsoap <postponed> (Minor issue)
https://www.genivia.com/advisory.html#Upgrade_recommendation_when_option_-c++11_is_used_to_generate_C++11_source_code
https://www.genivia.com/changelog.html#Version_2.8.133_(03/21/2024)
Fixed by: https://sourceforge.net/p/gsoap2/code/222/

Search for package or bug name: Reporting problems