CVE-2022-27897 — Palantir Gotham included an endpoint that would log arbitrary sized zip files.

CVE-2022-27897

Palantir Gotham included an endpoint that would log arbitrary sized zip files. PUBLISHED

Description (CNA)

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server.

Affected (CNA)

Vendor / product	Versions
Palantir / Gotham	affected unspecified before 3.22.11.2

CWE

CWE-20

References

https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-12.md

ADP enrichment

CVE

No English description supplied.

https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-12.md

CISA-ADP

No English description supplied.

No references supplied.