CVE-2022-43766

Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to avoid it.
References
Link Resource
https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*

History

28 Oct 2022, 17:43

Type Values Removed Values Added
CPE cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
References (CONFIRM) https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn - (CONFIRM) https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn - Mailing List, Vendor Advisory
CWE NVD-CWE-noinfo

26 Oct 2022, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-10-26 16:15

Updated : 2024-02-04 22:51


NVD link : CVE-2022-43766

Mitre link : CVE-2022-43766

CVE.ORG link : CVE-2022-43766


JSON object : View

Products Affected

apache

  • iotdb