GitHub Advisoryadvisory · Maven, PyPI

GHSA-g6hg-4v3c-6jq7 Apache IoTDB subject to ReDOS with Java 8

HIGH Published 2022-10-26 Modified 2026-06-09 Official page ↗
Aliases
CVE-2022-43766
Ecosystem
Maven, PyPI
Packages
org.apache.iotdb:flink-tsfile-connector, apache-iotdb, org.apache.iotdb:iotdb-server, org.apache.iotdb:tsfile
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2022-10-27

Affected packages

• Maven org.apache.iotdb:flink-tsfile-connector: >= 0.12.2, < 0.13.3 → fixed in 0.13.3 • PyPI apache-iotdb: >= 0.12.2, < 0.13.3 → fixed in 0.13.3 • Maven org.apache.iotdb:iotdb-server: >= 0.12.2, < 0.13.3 → fixed in 0.13.3 • Maven org.apache.iotdb:tsfile: >= 0.12.2, < 0.13.3 → fixed in 0.13.3

Description

Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.

Related

Alias · CVE (1)

  • CVE-2022-43766 Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References