DOS via OFS_DELTA in Dulwich before 1.2.9

Executive Summary

This is a Denial of Service (DoS) vulnerability in the dulwich library affecting versions before 1.2.9. It occurs in the Pack.resolve_object method where an infinite loop happens when processing OFS_DELTA objects with a delta_offset of 0. This causes the system to repeatedly reference the same object, consuming all CPU resources and crashing the process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the dulwich library version on your system using commands like 'pip show dulwich' or 'git --version' if dulwich is integrated with Git. If the version is below 1.2.9, the system is vulnerable. Monitor CPU usage during Git operations such as clone, fetch, or cat-file for unexpected spikes.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this flaw to cause 100% CPU usage and system unresponsiveness during Git operations like clone, fetch, or cat-file. This leads to service disruption and potential downtime for systems relying on dulwich.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by exhausting CPU resources, which could lead to system unavailability. While it does not directly expose or leak data, prolonged downtime may impact compliance with availability requirements in regulations like GDPR (Article 32) and HIPAA (Security Rule). However, the vulnerability itself does not violate data protection principles such as confidentiality or integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade the dulwich library to version 1.2.9 or later using 'pip install --upgrade dulwich'. If upgrading is not possible, restrict access to Git operations that process packfiles or implement network-level controls to block malicious packfiles.

Useful 0 Not Useful 0