Bug 2274109 (CVE-2024-3508)

Summary:	CVE-2024-3508 bzip2: Compressed Content Bomb Leads to Denial of Service of Bombastic API
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	afield, dbosanac, jreimann, mdessi, mrizzi, pcattana
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2274110, 2274111
Bug Blocks:	2274108

Description Rohit Keshri 2024-04-09 07:53:33 UTC

Bombastic allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON, to perform this verification the uploaded file must first be decompressed.

The decompression of malicious bzip2-compressed JSON can cause memory exhaustion: a 69 Kb bzip2 compressed file can be uncompressed to the order of 100 Gb. This causes the pod to become unresponsive and quickly leads to its eviction by OpenShift. A new pod is then re-deployed in lieu of the evicted one.

Note: malicious JSON compressed with zstd do not seem to be affected by this attack.

Comment 1 Rohit Keshri 2024-04-09 07:55:01 UTC

Created bzip2 tracking bugs for this issue:

Affects: fedora-all [bug 2274110]


Created mingw-bzip2 tracking bugs for this issue:

Affects: fedora-all [bug 2274111]