Advisoriesby IbisiotdbGHSA-g6hg-4v3c-6jq7
Apache IoTDB subject to ReDOS with Java 8
Fix: upgrade to 0.13.3 or later
Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-iotdb PyPI | >= 0.12.2, < 0.13.3 | 0.13.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-400
- Also known as
- CVE-2022-43766, PYSEC-2022-42972
More iotdb advisories
All iotdb
Remote Code Execution vulnerability in Apache IoTDB via UDFCVE-2023-46226fixed in 1.3.0Apache IoTDB Grafana Connector vulnerable to Improper AuthenticationCVE-2023-24831fixed in 0.13.5iotdb: improper authorizationCVE-2023-30771no fix yetiotdb: improper authorizationCVE-2023-24829fixed in 0.13.3iotdb: improper authenticationCVE-2023-24830fixed in 0.13.3Apache IoTDB Session Fixation vulnerabilityCVE-2022-38369fixed in 0.13.1