CVE-2018-16789

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.

libhttp/url.c en shellinabox, hasta la versión 2.20, tiene un error de implementación en la lógica de análisis de peticiones HTTP. Mediante el envío de una petición HTTP multipart/form-data manipulada, un atacante podría explotar esto para forzar a shellinaboxd a entrar en un bucle infinito, agotando los recursos de la CPU disponibles y provocando la caída del servicio.