CVE-2024-3508: Bzip2: compressed content bomb leads to denial of service of bombastic api
A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.
Other sources
Bombastic allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON, to perform this verification the uploaded file must first be decompressed.
The decompression of malicious bzip2-compressed JSON can cause memory exhaustion: a 69 Kb bzip2 compressed file can be uncompressed to the order of 100 Gb. This causes the pod to become unresponsive and quickly leads to its eviction by OpenShift. A new pod is then re-deployed in lieu of the evicted one.
Note: malicious JSON compressed with zstd do not seem to be affected by this attack.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3508?
CVE-2024-3508 is rated as a medium severity vulnerability due to its potential to allow authenticated users to upload malicious files.
How do I fix CVE-2024-3508?
To fix CVE-2024-3508, update Bombastic to the latest version where the vulnerability has been addressed.
Who is affected by CVE-2024-3508?
CVE-2024-3508 affects users of Bombastic and Red Hat's Trusted Profile Analyzer.
What types of files are exploited in CVE-2024-3508?
CVE-2024-3508 exploits compressed files specifically in the bzip2 or zstd formats.
What are the consequences of CVE-2024-3508?
If exploited, CVE-2024-3508 may lead to unauthorized actions through uploaded malicious files.