[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2022-26650: Apache ShenYu (incubating) Regular expression denial of service
From:       Zhang Yonglun <zhangyonglun () apache ! org>
Date:       2022-05-17 5:50:48
Message-ID: CA+ZBtZ7fwTPbbEcZbd0qPQHqB4xZDg1LRhk2hZSEUBx0Qj7waA () mail ! gmail ! com
[Download RAW message or body]

Severity: moderate

Description:

In ShenYu-Bootstrap there's RegexPredicateJudge.java which uses
Pattern.matches(conditionData.getParamValue(), realData) to make
judgments, where both parameters are controllable by the user. This
can cause an attacker pass in malicious regular expressions and
characters causing a resource exhaustion.
This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2.

Mitigation:

Upgrade to Apache ShenYu (incubating) 2.4.3 or apply patch
https://github.com/apache/incubator-shenyu/pull/2975.

--

Zhang Yonglun
Apache ShenYu (Incubating)
Apache ShardingSphere
[prev in list] [next in list] [prev in thread] [next in thread]