High severityNVD Advisory· Published Sep 20, 2023· Updated Sep 24, 2024
Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input
CVE-2023-37279
Description
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/contribsys/faktoryGo | < 1.8.0 | 1.8.0 |
Affected products
2- Range: < 1.8.0
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-x4hh-vjm7-g2jvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-37279ghsaADVISORY
- github.com/contribsys/faktory/security/advisories/GHSA-x4hh-vjm7-g2jvghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.