[Security Advisory] bmcweb: 100-continue not enforcing max payload size

Hi all,

A new GitHub Security Advisory has been published for bmcweb:

GHSA-p3gc-68x5-g9w3: 100-continue not enforcing max payload size
https://github.com/openbmc/bmcweb/security/advisories/GHSA-p3gc-68x5-g9w3

Summary:
Affected versions of bmcweb do not correctly enforce the maximum payload size during the HTTP 100-continue handling path. A remote attacker can send a crafted HTTP request containing both Expect: 100-continue and a sufficiently large payload, causing bmcweb to crash.

Impact:
This is a denial-of-service vulnerability. No authentication is required.

Fix:
https://gerrit.openbmc.org/c/openbmc/bmcweb/+/87688

Severity:
High
CVSS v3.1: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions:
bmcweb 2.18.0 and earlier

Introduced in:
bmcweb commit 1d1d778

Patched versions:
bmcweb 3.0.0
https://gerrit.openbmc.org/c/openbmc/bmcweb/+/87688

Workarounds:
If upgrading immediately is not possible, restrict access to the BMC. BMCs should be placed behind management networks or firewalls.

CVE:
No CVE at this time.

For more information:
If you have any questions or comments about this advisory:

Email openbmc-security at lists.ozlabs.org

Thanks,
Gunnar