This report came up in another discussion today, so for clarity I just wanted to state that the VMT is considering it a security hardening opportunity for now. If this is an avenue for filling up a reasonably provisioned database before an operator's typical database resource monitoring solution would alert them to the situation so they could disable the user's accounts, then we could reconsider issuing an advisory about it once fixed.
This report came up in another discussion today, so for clarity I just wanted to state that the VMT is considering it a security hardening opportunity for now. If this is an avenue for filling up a reasonably provisioned database before an operator's typical database resource monitoring solution would alert them to the situation so they could disable the user's accounts, then we could reconsider issuing an advisory about it once fixed.