CVE-2019-17555: Input Validation
Published Dec 4, 2019
·Updated
The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.
Affected Software
1 affected component
Apache Olingo>=4.0.0<=4.6.0
Event History
Dec 4, 2019
CVE Published
via MITRE·05:06 PM
Data Sourced
via MITRE·05:06 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2019-17555.
2
What is the severity of CVE-2019-17555?
The severity of CVE-2019-17555 is high.
3
What is the affected software?
The affected software is Apache Olingo versions 4.0.0 to 4.6.0.
4
How does CVE-2019-17555 allow a DoS attack?
CVE-2019-17555 allows a DoS attack by allowing a malicious server to return a huge value in the Retry-After header, which is then passed to the Thread.sleep() method without any check.
5
Is there a fix available for CVE-2019-17555?
Yes, it is recommended to update to a version of Apache Olingo that is not affected by this vulnerability.