| packages: |
| - module: github.com/tendermint/tendermint |
| package: github.com/tendermint/tendermint/rpc/client |
| symbols: |
| - makeHTTPClient |
| versions: |
| - fixed: 0.31.1 |
| description: | |
| Due to support of Gzip compression in request bodies, as well |
| as a lack of limiting response body sizes, a malicious server |
| can cause a client to consume a significant amount of system |
| resources, which may be used as a denial of service vector. |
| published: 2021-04-14T20:04:52Z |
| credit: '@guagualvcha' |
| cve_metadata: |
| id: CVE-2019-25072 |
| cwe: "CWE-400: Uncontrolled Resource Consumption" |
| links: |
| pr: https://github.com/tendermint/tendermint/pull/3430 |
| commit: https://github.com/tendermint/tendermint/commit/03085c2da23b179c4a51f59a03cb40aa4e85a613 |
