Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

pmm-managed DoS

Description

Certain requests like GET /.x cause an infinite loop in pmm-managed's AuthServer.authenticate method and nextPrefix function. Effectively, that's a DoS vector that can be exploited by anyone who knows the PMM Server address. Credentials knowledge is not required.

That's an unintended side effect of the AWS setup wizard introduced in 2.2.0. No other versions are affected.

https://github.com/percona/pmm-managed/pull/325

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7920

How to test

None

How to document

None

Smart Checklist

Activity

Done

Details

Assignee

Reporter

Priority

Components

Labels

Needs QA

Yes

Needs Doc

Yes

Fix versions

Story Points

Sprint

Affects versions

Smart Checklist

Created December 29, 2019 at 11:07 AM
Updated March 6, 2024 at 5:02 AM
Resolved January 23, 2020 at 3:47 PM