You are viewing this page in an unauthorized frame window.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
An official website of the United States government
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
This CVE record has been marked for NVD enrichment efforts.
Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.
Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.
This issue affects tesla: from 1.3.0 before 1.18.3.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Title: tesla de elixir-tesla, Description: Vulnerabilidad de asignación de recursos sin límites ni estrangulamiento en elixir-tesla tesla permite la denegación de servicio mediante el agotamiento de la tabla de átomos en Tesla.Adapter.Mint.
Tesla.Adapter.Mint.open_conn/2 convierte el esquema de URL de cada solicitud saliente a un átomo BEAM mediante String.to_atom(uri.scheme) sin validación de lista de permitidos. Los átomos BEAM nunca se recolectan y la tabla de átomos está limitada (aproximadamente 1.048.576 entradas por defecto). Un atacante que puede influir en la URL de una solicitud de Tesla - ya sea a través de una característica de reenvío de URL a nivel de aplicación (webhook, proxy, importador) o a través de un encabezado Location devuelto por un servidor cuando Tesla.Middleware.FollowRedirects está en la cadena de procesamiento - puede crear un nuevo átomo permanente por solicitud variando la cadena del esquema. Después de suficientes solicitudes, la tabla de átomos se llena y la VM falla, provocando la caída de toda la aplicación.
Este problema afecta a tesla: desde 1.3.0 hasta antes de 1.18.3.
Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion in Tesla.Adapter.Mint.
Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every outgoing request to a BEAM atom via String.to_atom(uri.scheme) with no allow-list validation. BEAM atoms are never garbage-collected and the atom table is bounded (approximately 1,048,576 entries by default). An attacker who can influence the URL of a Tesla request — either via an application-level URL-forwarding feature (webhook, proxy, importer) or via a Location header returned by a server when Tesla.Middleware.FollowRedirects is in the pipeline — can mint one fresh permanent atom per request by varying the scheme string. After enough requests the atom table fills and the VM crashes, taking down the entire application.
This issue affects tesla: from 1.3.0 before 1.18.3.
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
