What is GHSA-477x-w7m6-c6ph?

GHSA-477x-w7m6-c6ph is a security advisory published by GitHub Security Advisories with High severity. Improper input validation in Apache Olingo

Which CVE IDs does GHSA-477x-w7m6-c6ph cover?

GHSA-477x-w7m6-c6ph covers the following CVE IDs: CVE-2019-17555. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-477x-w7m6-c6ph?

GHSA-477x-w7m6-c6ph has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-477x-w7m6-c6ph?

GHSA-477x-w7m6-c6ph affects 1 product, including: maven/org.apache.olingo:odata-client-core:\u003e= 4.0.0, \u003c= 4.6.0.

GHSA-477x-w7m6-c6phHighCVSS 7.5

Improper input validation in Apache Olingo

Vendor

GitHub Security Advisories

Published

February 4, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2019-17555 →

📋 Description

The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.

🎯 Affected products1

maven/org.apache.olingo:odata-client-core:>= 4.0.0, <= 4.6.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-17555
https://github.com/apache/olingo-odata4/pull/61
https://issues.apache.org/jira/browse/OLINGO-1411
https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d65UmudJ_MQkFXEv9YY_wwZbRA3sgtNDzMoLM51Qh%3DRCA%40mail.gmail.com%3E
https://github.com/advisories/GHSA-477x-w7m6-c6ph