Description
The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attackers to cause a denial of service (resource exhaustion) via an HTTP POST request with a large Content-Length.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sql-ledger | No fix yet | — |
| Debian 13 | sql-ledger | No fix yet | — |
| Debian 12 | sql-ledger | No fix yet | — |
References
- 31843 third-party-advisory
- 31109 vdb-entry
- ledgersmb-contentlength-dos(45033) vdb-entry
- 20080910 Multiple Vulnerabilities: LedgerSMB < 1.2.15 mailing-list
- http://www.ledgersmb.org/node/70
- 4250 third-party-advisory