CVE-2018-16949: High severity npm vulnerability
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16949?
CVE-2018-16949 is classified as a high severity vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2018-16949?
To fix CVE-2018-16949, upgrade OpenAFS to version 1.6.23 or 1.8.2 or later.
What types of software are affected by CVE-2018-16949?
CVE-2018-16949 affects OpenAFS versions before 1.6.23 and 1.8.x before 1.8.2, as well as Debian Linux versions 8.0 and 9.0.
What kind of attack can be executed using CVE-2018-16949?
An attacker can exploit CVE-2018-16949 by sending maliciously large RPC input values to the server.
Is CVE-2018-16949 vulnerable to authenticated attacks?
CVE-2018-16949 is vulnerable to unauthenticated attacks, meaning attackers do not need to be authenticated to exploit the vulnerability.