documentation_complete: true

prodtype: osp7

title: 'Check-Block-08: Is max size for the body of a request set to default (114688)?'

description: |-
    If the maximum body size per request is not defined, the attacker can craft an arbitrary osapi request of large size causing the service to crash and finally resulting in Denial Of Service attack. Assigning the maximum value ensures that any malicious oversized request gets blocked ensuring continued availability of the service.

    <br />
    <br />
    Pass: If value of parameter osapi_max_request_body_size under [DEFAULT] section in /etc/cinder/cinder.conf is set to 114688 or if value of parameter max_request_body_size under [oslo_middleware] section in /etc/cinder/cinder.conf is set to 114688.

    <br />
    <br />
    Fail: If value of parameter osapi_max_request_body_size under [DEFAULT] section in /etc/cinder/cinder.conf is not set to 114688 or if value of parameter max_request_body_size under [oslo_middleware] section in /etc/cinder/cinder.conf is not set to 114688.

rationale: ""

severity: unknown

identifiers:
    cce: RHELOSP-CCE-TBD

references:
    nist: FOO-1(a)
