topic Re: Memory Leak as Denial of service attack in Alfresco Forum

Memory Leak as Denial of service attack

jjrabadan — Mon, 21 Nov 2022 14:20:22 GMT

Goog morning:

I'd like to know if the community versions of Alfresco have also this issue. If so, are there any patches ready to fix this problem?

Thank you.

Best regards,

Re: Memory Leak as Denial of service attack

angelborroy — Mon, 21 Nov 2022 14:49:57 GMT

May you give more details on the issue?

I'm not aware of any similar to the one you describe.

Re: Memory Leak as Denial of service attack

Coin — Mon, 21 Nov 2022 15:39:54 GMT

We received this email from Hyland last Friday:

But I'm unable to access the detail page for this. @angelborroy is there a CVE description with details about version & general impact of this vulnerability?

Thanks!

Re: Memory Leak as Denial of service attack

angelborroy — Mon, 21 Nov 2022 16:05:00 GMT

I'm not able to find that Technical Bulletin, not sure if that was published / distributed by error.

Re: Memory Leak as Denial of service attack

jjrabadan — Tue, 22 Nov 2022 14:00:29 GMT

Hello, Angel:

thank you for your answer. Can you verify this point with the development team? If this security issue also happens on Community edition, a patch is needed (in orther to set the maximum memory an script can manage). There are several customers in the world that use Alfresco Community in production environment.....

Thank you.

Best regards.

Re: Memory Leak as Denial of service attack

angelborroy — Tue, 22 Nov 2022 14:26:56 GMT

Server side JavaScript code in Alfresco Repository is allowed, but this is mainly restricted to administrator users. The product can be limited / restricted in features in order to protect yourself from your administrators... but does this make sense?