CVE-2021-32623: Opencast vulnerable to billion laughs attack (XML bomb)
Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-32623?
CVE-2021-32623 is a vulnerability in Opencast versions prior to 9.6 that allows an attacker to execute a denial of service attack by exploiting the billion laughs attack.
How does the billion laughs attack work?
The billion laughs attack is an XML entity expansion attack where an attacker crafts a malicious XML file with nested entity references that result in exponential expansion, overwhelming the system and causing a denial of service.
What is the severity of CVE-2021-32623?
CVE-2021-32623 has a severity rating of 6.5 (high).
How can I fix the CVE-2021-32623 vulnerability?
To fix the CVE-2021-32623 vulnerability, upgrade to Opencast version 9.6 or later.
Where can I find more information about CVE-2021-32623?
More information about CVE-2021-32623 can be found in the references section of the vulnerability report.