SB20260827151 - Two DoS vulnerabilities in MapServer

Description

This security bulletin contains information about 2 vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the WMS GetMap FILTER parser and processing path when handling a crafted FILTER parameter containing an element with many sibling clauses. A remote attacker can send a specially crafted GetMap request to cause a denial of service.

The issue is triggered before any map image is produced and does not depend on valid data or matching records, but it requires a WMS layer that accepts a FILTER parameter.

2) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in msInterpolationDataset() in src/interpolation.c when handling an unauthenticated WMS GetMap request for published interpolation layers with crafted WIDTH and HEIGHT values. A remote attacker can send a specially crafted GetMap request to cause a denial of service.

Only instances that publish interpolation layers using CONNECTIONTYPE IDW or CONNECTIONTYPE KERNELDENSITY are vulnerable.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://github.com/MapServer/MapServer/security/advisories/GHSA-5fx4-vjp9-863f
• https://github.com/MapServer/MapServer/security/advisories/GHSA-59gr-4vvx-5f56