Detections
Analytics

SCA: security update for bref/bref (GHSA-j4hq-f63x-f39r)

medium Tenable Self-Hosted Container Security Plugin ID 416124

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref
 prior to version 2.1.17 is used with the Event-Driven Function runtime and the handler is a
 `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion
 process, if the request is a MultiPart, each part is parsed. In the parsing process, the `Content-Type`
 header of each part is read using the `Riverline/multipart-parser` library. The library, in the
 `StreamedPart::parseHeaderContent` function, performs slow multi-byte string operations on the header
 value. Precisely, the `mb_convert_encoding` function is used with the first (`$string`) and third
 (`$from_encoding`) parameters read from the header value. An attacker could send specifically crafted
 requests which would force the server into performing long operations with a consequent long billed
 duration. The attack has the following requirements and limitations: The Lambda should use the Event-
 Driven Function runtime and the `RequestHandlerInterface` handler and should implement at least an
 endpoint accepting POST requests; the attacker can send requests up to 6MB long (this is enough to cause a
 billed duration between 400ms and 500ms with the default 1024MB RAM Lambda image of Bref); and if the
 Lambda uses a PHP runtime <= php-82, the impact is higher as the billed duration in the default 1024MB RAM
 Lambda image of Bref could be brought to more than 900ms for each request. Notice that the vulnerability
 applies only to headers read from the request body as the request header has a limitation which allows a
 total maximum size of ~10KB. Version 2.1.17 contains a fix for this issue. (CVE-2024-29186)

See Also

https://github.com/advisories/GHSA-j4hq-f63x-f39r

Plugin Details

Severity: Medium

ID: 416124

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2024-29186

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/22/2024

Vulnerability Publication Date: 3/22/2024

Reference Information

CVE: CVE-2024-29186

cwe: CWE-400