CVE-2016-5004 ws-xmlrpc DoS Vulnerability
MediumCVSS 6.5
EPSS 7.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.xmlrpc/xmlrpc-common(Maven) | <= 3.1.3 | No fix listed |
| org.apache.xmlrpc/xmlrpc-common(Maven) | = 3.0 | No fix listed |
| org.apache.xmlrpc/xmlrpc-common(Maven) | = 3.0b1 | No fix listed |
| org.apache.xmlrpc/xmlrpc-common(Maven) | = 3.0rc1 | No fix listed |
| org.apache.xmlrpc/xmlrpc-common(Maven) | = 3.1 | No fix listed |
| org.apache.xmlrpc/xmlrpc-common(Maven) | = 3.1.1 | No fix listed |
| org.apache.xmlrpc/xmlrpc-common(Maven) | = 3.1.2 | No fix listed |
| org.apache.xmlrpc/xmlrpc-common(Maven) | = 3.1.3 | No fix listed |
| apache ws-xmlrpc | = 3.1.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit third-party-advisory
- [oss-security] 20160712 Vulnerabilities in Apache Archiva mailing-list third-party-advisory
- web.archive.org
- web.archive.org
- web.archive.org
- github.com
- 91736 third-party-advisory vdb-entry
- 1036294 third-party-advisory vdb-entry
- 0ang3el.blogspot.in third-party-advisory