The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
References
| Link | Resource |
|---|---|
| https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5 | Patch Third Party Advisory |
| https://github.com/eclipse/milo/issues/1030 | Issue Tracking Patch Third Party Advisory |
| https://github.com/eclipse/milo/pull/1031 | Patch Third Party Advisory |
| https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191 | Third Party Advisory |
Configurations
History
13 Sep 2022, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Eclipse milo
Eclipse |
|
| CPE | cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-770 | |
| References | (CONFIRM) https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5 - Patch, Third Party Advisory | |
| References | (CONFIRM) https://github.com/eclipse/milo/pull/1031 - Patch, Third Party Advisory | |
| References | (CONFIRM) https://github.com/eclipse/milo/issues/1030 - Issue Tracking, Patch, Third Party Advisory | |
| References | (CONFIRM) https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191 - Third Party Advisory |
08 Sep 2022, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-09-08 05:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-25897
Mitre link : CVE-2022-25897
CVE.ORG link : CVE-2022-25897
JSON object : View
Products Affected
eclipse
- milo
CWE
CWE-770
Allocation of Resources Without Limits or Throttling