GHSA-9759-3276-g2pm

Suggest an improvement
Source
https://github.com/advisories/GHSA-9759-3276-g2pm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-9759-3276-g2pm/GHSA-9759-3276-g2pm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9759-3276-g2pm
Aliases
Published
2023-12-13T23:15:56Z
Modified
2023-12-19T20:39:57Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Cube API denial of service attack
Details

Impact

It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.

Patches

The issue has been patched in the v0.34.34 and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption.

Workarounds

There are currently no workaround for older versions, and the recommendation is to upgrade.

References

The issue was reported by y0d3n in our Community Slack and has been promptly patched in the recent update.

Database specific 
{
    "cwe_ids": [
        "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-13T23:15:56Z",
    "nvd_published_at": "2023-12-13T22:15:43Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / @cubejs-backend/api-gateway

Package

Name
@cubejs-backend/api-gateway
View open source insights on deps.dev
Purl
pkg:npm/%40cubejs-backend/api-gateway

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.34.34

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-9759-3276-g2pm/GHSA-9759-3276-g2pm.json"