GHSA-f3wf-q4fj-3gxf: 
PHP vulnerability analysis and mitigation

A Denial of Service vulnerability was discovered in TYPO3 CMS's Online Media Asset Handling component, identified as TYPO3-CORE-SA-2018-011. The vulnerability affects TYPO3 versions 7.0.0-7.6.31, 8.0.0-8.7.20, and 9.0.0-9.5.1, and was disclosed on December 11, 2018. The issue specifically impacts the handling of *.youtube and *.vimeo files in the TYPO3 backend (TYPO3 Advisory).

The vulnerability occurs when handling large media files (*.youtube, *.vimeo) in the TYPO3 core, which could lead to denial of service scenarios. The issue was addressed by implementing a limit on media files to have a content size of maximum 2048 bytes, as these files typically only contain the remote identifier and normally require around 20 bytes (TYPO3 Commit). The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Moderate severity) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

When exploited, this vulnerability results in high consumption of system resources, which can lead to exceeding limits of the current PHP process. This ultimately results in a dysfunctional backend component, affecting the availability of the system (TYPO3 Advisory).

Exploitation of this vulnerability requires either a valid backend user account or write access on the server system (e.g., SFTP). The attack complexity is considered low, but privileges are required for exploitation (TYPO3 Advisory).

The vulnerability was patched in TYPO3 versions 7.6.32, 8.7.21, and 9.5.2. Users are advised to update to these versions or later to address the issue. The fix implements a 2048-byte size limit on media identifier files (GitHub Advisory).