Lucene search

K
atlassian4497831d53eeATLASSIAN:CRUC-8498
HistoryNov 18, 2020 - 9:48 p.m.

A user-supplied regex in EyeQL causes ReDoS - CVE-2020-14190

2020-11-1821:48:51
4497831d53ee
jira.atlassian.com
30
atlassian fisheye
crucible
remote code execution

EPSS

0.002

Percentile

61.9%

Affected version of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL.

The affected versions are before version 4.8.4.

Affected versions:

  • version < 4.8.4

Fixed versions:

  • 4.8.4
  • 4.9.0

EPSS

0.002

Percentile

61.9%

Related for ATLASSIAN:CRUC-8498