Cube API denial of service attack

Description

It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.

Recommendation

Update the @cubejs-backend/api-gateway package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.34.34
• Patched version(s): 0.34.34

References

• GHSA-9759-3276-g2pm
• CVE-2023-50709
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Unauthenticated Denial of Service in the octokit/webhooks library (GHSA-pwfr-8pq7-x9qv) 2 - CVE-2023-50728
• Unauthenticated Denial of Service in the octokit/webhooks library - CVE-2023-50728
• MathJax Regular expression Denial of Service (ReDoS) - CVE-2023-39663
• Unauthenticated Denial of Service in the octokit/webhooks library (GHSA-pwfr-8pq7-x9qv) - CVE-2023-50728

Tags:

npm

@cubejs-backend/api-gateway