Skip to content
This repository has been archived by the owner on Oct 1, 2018. It is now read-only.

Specially crafted SWA request can take down server with OOM #77

Open
glassfishrobot opened this issue Dec 2, 2014 · 3 comments
Open

Specially crafted SWA request can take down server with OOM #77

glassfishrobot opened this issue Dec 2, 2014 · 3 comments
Assignees
@glassfishrobot
Labels
Component: code ERR: Assignee Priority: Major Type: Bug

Comments

@glassfishrobot
Copy link
Contributor

Currently there is no protection against malicious SWA requests where the SOAP part of the request is specially crafted to consume as much memory as possible on the server (in the XML parser). This might lead to OOM and system unavailability. We have created a fix (lets you set max size of body part) that can be found here: https://github.com/digipost/saaj/commit/1e65b801508e6be12ece76120dd00ad04022f4c0

Affected Versions

[current]
@glassfishrobot
Copy link
Contributor Author

Reported by slandro

@glassfishrobot
Copy link
Contributor Author

Was assigned to gagordon

@glassfishrobot
Copy link
Contributor Author

This issue was imported from java.net JIRA SAAJ-77

@glassfishrobot glassfishrobot self-assigned this Apr 24, 2017
@Tomas-Kraus Tomas-Kraus mentioned this issue Sep 24, 2018
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@glassfishrobot glassfishrobot

Labels
Component: code ERR: Assignee Priority: Major Type: Bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@glassfishrobot