PT-2020-16885
CVE-2020-27978
·
تاريخ النشر
2020-10-28
·
تاريخ التحديث
2022-02-08
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions
Shibboleth Identify Provider versions prior to 3.4.6
Description
The issue is a denial of service flaw that allows a remote unauthenticated attacker to cause a login flow to trigger Java heap exhaustion. This occurs due to the creation of objects in the Java Servlet container session.
Recommendations
For versions prior to 3.4.6, update to version 3.4.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the login flow to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾