Chi tiết CWE-410

The product's resource pool is not large enough to handle peak demand.

Các cách xuất hiện

Architecture and Design
Implementation
Operation

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)
Tên: Python (Undetermined)

Hậu quả phổ biến

Ví dụ đã quan sát

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
Phases : Architecture and Design
Consider implementing a velocity check mechanism which would detect abusive behavior.
Phases : Operation
Consider load balancing as an option to handle heavy loads.
Phases : Implementation
Make sure that resource handles are properly closed when no longer needed.
Phases : Architecture and Design
Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. Flooding attacks often cause a crash or other problem besides denial of the resource itself; these are likely examples of other weaknesses, not an insufficient resource pool.

Tài liệu tham khảo

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-1541

Secure Coding Guide for Python
OpenSSF.
https://best.openssf.org/Secure-Coding-Guide-for-Python/

Gửi

Sửa đổi