GMS-2020-705: Denial of Service in apostrophe

September 3, 2020 (updated September 29, 2021)

Versions of apostrophe prior to 2.97.1 are vulnerable to Denial of Service. The apostrophe-jobs module sets a callback for incoming jobs and doesn’t clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to start a large number of jobs and exhaust system memory.

Recommendation

Upgrade to version 2.97.1 or later.

References

github.com/advisories/GHSA-pv6r-vchh-cxg9
www.npmjs.com/advisories/1183

Code Behaviors & Features

Detect and mitigate GMS-2020-705 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →