Snowplow Iglu/Collector/Enrich/Snowbridge Multiple Critical DoS Vulnerabilities (CVE-2024-47212, CVE-2024-47214, CVE-2024-47217, CVE-2024-56528, CVE-2024-47213, CVE-2024-47215)

Critical Vulnerability Information Iglu Server CVE-2024-47212: Iglu Server Denial of Service #1 - Classification: Critical DoS Vulnerability - 8.8 CVSS Overall Score - Fixed in: Iglu Server 0.13.1 - Affected Versions: Iglu Server 0.13.0 and earlier - Description: Sending an extremely large payload to a specific API endpoint causes Iglu Server to become completely unresponsive. CVE-2024-47214: Iglu Server Denial of Service #2 - Classification: Critical DoS Vulnerability - 9.1 CVSS Overall Score - Fixed in: Iglu Server 0.13.1 - Affected Versions: Iglu Server 0.13.0 and earlier - Description: Involves malicious payloads that cause Iglu Server to become completely unresponsive. CVE-2024-47217: Iglu Server Denial of Service #3 - Classification: Critical DoS Vulnerability - 8.1 CVSS Overall Score - Fixed in: Iglu Server 0.13.1 - Affected Versions: Iglu Server 0.13.0 and earlier - Description: Involves authenticated endpoints, leading to Iglu Server becoming completely unresponsive. Collector CVE-2024-56528: Collector Denial of Service - Classification: Critical DoS Vulnerability - 7.0 CVSS Overall Score - Fixed in: Collector 3.3.0 - Affected Versions: Collector 3.x (unless deployed behind a proxy) - Description: Sending an extremely large payload causes Collector to become completely unresponsive. Enrich CVE-2024-47213: Enrich Denial of Service - Classification: Critical DoS Vulnerability - 9.1 CVSS Overall Score - Fixed in: Enrich 5.1.1 - Affected Versions: Enrich 5.1.0 and earlier - Description: Sending maliciously crafted Snowplow events causes Enrich to crash and restart indefinitely. Snowbridge CVE-2024-47215: Snowbridge Denial of Service - Classification: High DoS Vulnerability - 8.9 CVSS Overall Score - Fixed in: Configuration change - Affected Versions: Snowbridge configured to send data to Google Tag Manager Server Side - Description: Attaching invalid GTM SS preview headers causes events to retry indefinitely. - Mitigation: Add a filter to Snowbridge configuration.

Goal Reached Thanks to every supporter — we hit 100%!

Snowplow Iglu/Collector/Enrich/Snowbridge Multiple Critical DoS Vulnerabilities (CVE-2024-47212, CVE-2024-47214, CVE-2024-47217, CVE-2024-56528, CVE-2024-47213, CVE-2024-47215)