A vulnerability classified as problematic was found in CKAN up to 2.9.9/2.10.2. This vulnerability affects some unknown functionality of the file /dataset/new. The manipulation with an unknown input leads to a length parameter vulnerability. The CWE definition for the vulnerability is CWE-130. The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. As an impact it is known to affect availability. CVE summarizes:

CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.

The weakness was disclosed 12/13/2023 as GHSA-7fgc-89cx-w8j5. The advisory is available at github.com. This vulnerability was named CVE-2023-50248 since 12/05/2023. Technical details are known, but there is no available exploit.

Upgrading to version 2.9.10 or 2.10.3 eliminates this vulnerability. Applying the patch bd02018b65c5b81d7ede195d00d0fcbac3aa33be is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Productinfo

Name

• CKAN

Version

• 2.9.0
• 2.9.1
• 2.9.2
• 2.9.3
• 2.9.4
• 2.9.5
• 2.9.6
• 2.9.7
• 2.9.8
• 2.9.9
• 2.10.0
• 2.10.1
• 2.10.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion