CVE-2015-2313: High severity capnproto capnproto vulnerability
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a "tight" for loop. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/capnprototo a version that resolves this vulnerability.Fixed in 0.7.0-7Fixed in 0.9.2-2Fixed in 1.0.1-4 - Upgrade
Upgrade
Sandstorm Cap'n Prototo a version that resolves this vulnerability.Fixed in 0.4.1.1 - Upgrade
Upgrade
Sandstorm Cap'n Prototo a version that resolves this vulnerability.Fixed in 0.5.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2313?
CVE-2015-2313 is classified as a denial of service vulnerability impacting application performance due to high CPU consumption.
How do I fix CVE-2015-2313?
To resolve CVE-2015-2313, upgrade Cap'n Proto to version 0.4.1.1 or higher, or to one of the recommended fixed versions.
Which versions of Cap'n Proto are affected by CVE-2015-2313?
CVE-2015-2313 affects Cap'n Proto versions before 0.4.1.1 and those in the 0.5.x series before 0.5.1.2.
What type of attack does CVE-2015-2313 facilitate?
CVE-2015-2313 facilitates a denial of service attack by allowing remote peers to trigger excessive CPU usage.
What method in Cap'n Proto is associated with CVE-2015-2313?
The vulnerability in CVE-2015-2313 is associated with the totalSize method invoked on an object reader.