Evidence · DiggingBeagle record
Kubeflow Pipelines GHSA-8fmv-6rg5-5924 upload decompression advisory
Reviewed GitHub advisory for archive decompression exceeding resource bounds ahead of authorization.
- Source role
- primary disclosure
Evidence record
Reviewed GitHub advisory for archive decompression exceeding resource bounds ahead of authorization.
Claim-level citations (1)
- supportsKubeflow decompressed uploaded pipeline archives before bounding resource cost: The Kubeflow Pipelines advisory reports that a compact attacker-supplied pipeline archive could expand during extraction and exhaust API server memory before later request checks completed.
GHSA-8fmv-6rg5-5924, Summary, impact and fixed pseudo-version