Invalid request submitted to Team API can cause denial of service

[matt-richardson]

If a malformed request is submitted to the Team API, for either create or modify, the save is successful. However, the code that reads the team data isn't expecting the invalid data and hits a null reference exception.

Without that cache the server APIs cannot load permissions and return an error for all incoming requests. It isn't possible to create this situation through the portal, only through the API.

CVE: CVE-2019-19376

Relates to OctopusDeploy/OctopusDeploy#4740

[matt-richardson]

Fixed in https://github.com/OctopusDeploy/OctopusDeploy/commit/4c4528e95b1b02f61959046a67861494e6f60375

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you think you've found a related issue, please contact our support team so we can triage your issue, and make sure it's handled appropriately.