ManageIQ Denial-of-Service Vulnerability via Malformed TimeProfile Creation

A denial-of-service vulnerability has been identified in ManageIQ versions prior to radjabov-2. The issue arises in the ManageIQ API, where a malformed TimeProfile can be created. This improperly structured TimeProfile leads to timeouts in subsequent UI and API requests, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing requests to fail and potentially disrupting service availability.

Remediation

Users are advised to upgrade to ManageIQ version radjabov-2 or later. Alternatively, the patch available in commit 79cef10c7d0278d8a37c3f547c426948180df4df can be applied manually.