Lucene search

K
atlassian4497831d53eeATLASSIAN:FE-7336
HistoryNov 19, 2020 - 12:10 a.m.

A user-supplied regex in EyeQL causes ReDoS - CVE-2020-14190

2020-11-1900:10:43
4497831d53ee
jira.atlassian.com
39
atlassian
fisheye
crucible
redos
cve-2020-14190
regex denial of service
eyeql
remote attackers
version 4.8.4
version 4.9.0

EPSS

0.002

Percentile

61.9%

Affected version of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL.

The affected versions are before version 4.8.4.

Affected versions:

  • version < 4.8.4

Fixed versions:

  • 4.8.4
  • 4.9.0

EPSS

0.002

Percentile

61.9%

Related for ATLASSIAN:FE-7336