VWE-2017-3979 Viewing Source [template]Vulnerability | cve= | aka= | issueid=5026 | severity=High | difficulty=Easy | description=Decompression Bomb. | lite=no | discover-date=Related issue: April 28, 2017 Proof of concept: August 9, 2017 | patch-date=September 13, 2017 | patches=4.0.19 Patch Level 1 4.0.18 Patch Level 2 4.0.17 Patch Level 4 4.0.16 Patch Level 5 4.0.15 Patch Level 9 4.0.14 Patch Level 12 | workaround=For versions 4.0.14 and later, perform the following: [list=1][*]Set Options > VaultWiki: Content Types > Maximum Disk Usage for All Attachments (MB) = 0. This will reject all new uploads. [*]Set Options > VaultWiki: Miscellaneous > Maximum Disk Usage for All Proxy Images (MB) = 0. This will disable the external image proxy.[/list] After applying a patch, restore these settings to reactivate uploads and proxying. There is no workaround for versions 4.0.13 and earlier. They are no longer supported; update to a more recent version and perform the steps above.[/template] 989 characters