Uncontrolled Resource Consumption in Apache DolphinScheduler

CVE-2022-25598 · Published Mar 31, 2022 · updated Feb 16, 2024

High7.5

Fix: upgrade to 2.0.5 or later

Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks. Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.

Affected versions

Package	Affected	Fixed in
org.apache.dolphinscheduler:dolphinscheduler Maven	< 2.0.5	2.0.5

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-1333, CWE-400
Also known as: CVE-2022-25598, PYSEC-2022-176

More dolphinscheduler advisories

All dolphinscheduler

Critical 9.8Feb 20, 2024

Remote Code Execution in Apache DolphinschedulerCVE-2023-49109fixed in 3.2.1 High 7.5Nov 24, 2023

Apache DolphinScheduler sensitive information disclosureCVE-2023-48796fixed in 3.0.2 Critical 9.8Jan 4, 2023

Apache DolphinScheduler vulnerable to Improper Input ValidationCVE-2022-45875fixed in 3.0.2 +1 Medium 6.5Nov 1, 2022

Apache DolphinScheduler vulnerable to Path TraversalCVE-2022-34662fixed in 3.0.0 Medium 6.5Oct 28, 2022

Apache DolphinScheduler vulnerable to Path TraversalCVE-2022-26884fixed in 2.0.6 Critical 9.8Feb 9, 2022

Remote code execution in DolphinSchedulerCVE-2020-11974fixed in 1.3.0