« Volver al listado

CVE-2025-32944

Estado: AnalizadaMedia (6.5)—

The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner.  If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Framasoft — Peertube

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32944",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32944",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-15T13:29:49.083370Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "reefs@jfrog.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "reefs@jfrog.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7.1.1",
              "versionType": "custom"
            }
          ],
          "packageName": "Chocobozzz/PeerTube",
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-15T13:15:55.100",
  "references": [
    {
      "url": "https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1",
      "tags": [
        "Release Notes"
      ],
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://research.jfrog.com/vulnerabilities/peertube-archive-persistent-dos/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "reefs@jfrog.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "reefs@jfrog.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner.  If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad permite que cualquier usuario autenticado provoque el bloqueo persistente del servidor de PeerTube. Si la importación de usuarios está habilitada (configuración predeterminada), cualquier usuario registrado puede cargar un archivo para su importación. El código utiliza la librería yauzl para leer el archivo. Si la librería yauzl encuentra un nombre de archivo considerado ilegal, genera una excepción que PeerTube no detecta, lo que provoca un bloqueo que se repite indefinidamente al iniciar."
    }
  ],
  "lastModified": "2026-06-17T09:12:50.380",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:framasoft:peertube:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8E26564-C5EB-4B35-9E6B-2B4C4297D307",
              "versionEndExcluding": "7.1.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "reefs@jfrog.com"
}