What is CVE-2021-32623?

CVE-2021-32623 is a vulnerability in Opencast versions prior to 9.6 that allows an attacker to execute a denial of service attack by exploiting the billion laughs attack.

How does the billion laughs attack work?

The billion laughs attack is an XML entity expansion attack where an attacker crafts a malicious XML file with nested entity references that result in exponential expansion, overwhelming the system and causing a denial of service.

What is the severity of CVE-2021-32623?

CVE-2021-32623 has a severity rating of 6.5 (high).

How can I fix the CVE-2021-32623 vulnerability?

To fix the CVE-2021-32623 vulnerability, upgrade to Opencast version 9.6 or later.

Where can I find more information about CVE-2021-32623?

More information about CVE-2021-32623 can be found in the references section of the vulnerability report.

Vulnerability/
CVE-2021-32623

high

8.1

CWE

776

15/6/2021

3/8/2024

CVE-2021-32623: Opencast vulnerable to billion laughs attack (XML bomb)

First published: Tue Jun 15 2021(Updated: )

Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Apereo Opencast	<9.6

Remedy

https://github.com/opencast/opencast/commit/8ae27da5a6f658011a5741b3210e715b0dc6213e

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2021-32623?
CVE-2021-32623 is a vulnerability in Opencast versions prior to 9.6 that allows an attacker to execute a denial of service attack by exploiting the billion laughs attack.
How does the billion laughs attack work?
The billion laughs attack is an XML entity expansion attack where an attacker crafts a malicious XML file with nested entity references that result in exponential expansion, overwhelming the system and causing a denial of service.
What is the severity of CVE-2021-32623?
CVE-2021-32623 has a severity rating of 6.5 (high).
How can I fix the CVE-2021-32623 vulnerability?
To fix the CVE-2021-32623 vulnerability, upgrade to Opencast version 9.6 or later.
Where can I find more information about CVE-2021-32623?
More information about CVE-2021-32623 can be found in the references section of the vulnerability report.

collector/nvd-index
agent/references
agent/type
collector/mitre-cve
source/MITRE
agent/author
agent/severity
agent/title
agent/weakness
agent/remedy
agent/last-modified-date
agent/softwarecombine
agent/tags
agent/description
agent/first-publish-date
agent/event
vendor/apereo
canonical/apereo opencast

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.