CVE-2019-19376: Input Validation
In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19376?
CVE-2019-19376 has been classified as a denial of service vulnerability due to its impact on application availability.
How do I fix CVE-2019-19376?
To fix CVE-2019-19376, upgrade to Octopus Deploy version 2019.10.6 or later, or apply the backported fixes in LTS versions 2019.9.8 and 2019.6.14.
Who is affected by CVE-2019-19376?
Authenticated users with TeamEdit permission in versions of Octopus Deploy prior to 2019.10.6, along with certain LTS versions, are affected by CVE-2019-19376.
What causes CVE-2019-19376?
CVE-2019-19376 is caused by a malformed Team API request that bypasses input validation, leading to application-level denial of service.
Is CVE-2019-19376 present in all versions of Octopus Deploy?
No, CVE-2019-19376 only affects specific versions of Octopus Deploy prior to 2019.10.6 and certain LTS versions.