{"id":"CVE-2024-3508","state":"PUBLISHED","title":"Bzip2: compressed content bomb leads to denial of service of bombastic api","description":"A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.","publishedAt":"2024-04-25T17:46:21.762Z","updatedAt":"2025-11-20T19:02:23.754Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"redhat"},"assigner":"redhat","products":["bzip2","Red Hat Red Hat Trusted Profile Analyzer"],"affected":[{"packageName":"bzip2","defaultStatus":"unknown","versions":[{"version":"faa7a496c5d98e0f0859dd2c623eddf82289eaa8","status":"unaffected","versionType":"git"}],"collectionURL":"https://github.com/trustification/trustification"},{"vendor":"Red Hat","product":"Red Hat Trusted Profile Analyzer","packageName":"SBOM-Management-(Bombastic)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_profile_analyzer:1"]}],"references":["https://access.redhat.com/security/cve/CVE-2024-3508","https://bugzilla.redhat.com/show_bug.cgi?id=2274109"],"weaknesses":["CWE-400","CWE-434"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3508.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-3508","state":"PUBLISHED","datePublished":"2024-04-25T17:46:21.762Z","dateUpdated":"2025-11-20T19:02:23.754Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2024-04-09T08:03:26.957Z"},"containers":{"cna":{"title":"Bzip2: compressed content bomb leads to denial of service of bombastic api","descriptions":[{"lang":"en","value":"A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed."}],"affected":[{"packageName":"bzip2","defaultStatus":"unknown","versions":[{"version":"faa7a496c5d98e0f0859dd2c623eddf82289eaa8","status":"unaffected","versionType":"git"}],"collectionURL":"https://github.com/trustification/trustification"},{"vendor":"Red Hat","product":"Red Hat Trusted Profile Analyzer","packageName":"SBOM-Management-(Bombastic)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_profile_analyzer:1"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-3508","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274109","name":"RHBZ#2274109","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2025-11-20T19:02:23.754Z"},"datePublic":"2024-04-09T00:00:00.000Z","x_redhatCweChain":"CWE-400: Uncontrolled Resource Consumption","timeline":[{"lang":"en","time":"2024-04-09T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-04-09T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-04-26T15:53:37.655982Z","id":"CVE-2024-3508","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","type":"CWE","lang":"en","description":"CWE-434 Unrestricted Upload of File with Dangerous Type"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-02T14:11:51.584Z"}},{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-3508","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274109","name":"RHBZ#2274109","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:12:07.548Z"}}]}}}