Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2022-27897

Palantir Gotham included an endpoint that would log arbitrary sized zip files.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Palantir

Description

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palantir Gotham

  • unspecified to < 3.22.11.2affected

References