Description
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OW2 ASM
Default version status: unaffected
3.0 to < 9.11affected
pkg:maven/org.ow2.asm/asmReferences
- https://gitlab.ow2.org/asm/asm/-/merge_requests/463 ↗
- https://gitlab.ow2.org/asm/asm/-/commit/ab68bbd2521359b7c8cd3517c6331ced3d817ed0 ↗
- https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java#L1595 ↗
- https://asm.ow2.io/versions.html ↗
- https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-excessive-cpu-consumption-via-classwriter-compute-frames ↗