Lucene search
HistoryApr 27, 2009 - 10:30 p.m.
CVE-2009-1190
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
AI Score
9.2
Confidence
High
EPSS
0.278
Percentile
96.9%
Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.
Affected configurations
Node
sunjdkRange≤1.5.0update_22
ORsunjdkMatch1.1.0
ORsunjdkMatch1.1.6
ORsunjdkMatch1.1.6update7
ORsunjdkMatch1.1.7b
ORsunjdkMatch1.1.7bupdate5
ORsunjdkMatch1.1.8update10
ORsunjdkMatch1.1.8update13
ORsunjdkMatch1.1.8update14
ORsunjdkMatch1.1.8update2
ORsunjdkMatch1.1.8update7
ORsunjdkMatch1.1.8update8
ORsunjdkMatch1.2.0
ORsunjdkMatch1.2.1
ORsunjdkMatch1.2.1update3
ORsunjdkMatch1.2.2update4
ORsunjdkMatch1.2.2update5
ORsunjdkMatch1.3.0
ORsunjdkMatch1.3.0_01
ORsunjdkMatch1.3.0_02
ORsunjdkMatch1.3.0_03
ORsunjdkMatch1.3.0_04
ORsunjdkMatch1.3.0_05
ORsunjdkMatch1.3.1
ORsunjdkMatch1.3.1update19
ORsunjdkMatch1.3.1update20
ORsunjdkMatch1.3.1_01
ORsunjdkMatch1.3.1_01a
ORsunjdkMatch1.3.1_02
ORsunjdkMatch1.3.1_03
ORsunjdkMatch1.3.1_04
ORsunjdkMatch1.3.1_05
ORsunjdkMatch1.3.1_06
ORsunjdkMatch1.3.1_07
ORsunjdkMatch1.3.1_08
ORsunjdkMatch1.3.1_09
ORsunjdkMatch1.3.1_10
ORsunjdkMatch1.3.1_11
ORsunjdkMatch1.3.1_12
ORsunjdkMatch1.3.1_13
ORsunjdkMatch1.3.1_14
ORsunjdkMatch1.3.1_15
ORsunjdkMatch1.3.1_16
ORsunjdkMatch1.3.1_17
ORsunjdkMatch1.3.1_18
ORsunjdkMatch1.3.1_19
ORsunjdkMatch1.3.1_20
ORsunjdkMatch1.3.1_21
ORsunjdkMatch1.3.1_22
ORsunjdkMatch1.3.1_23
ORsunjdkMatch1.3.1_24
ORsunjdkMatch1.3.1_25
ORsunjdkMatch1.3.1_26
ORsunjdkMatch1.3.1_27
ORsunjdkMatch1.3.1_28
ORsunjdkMatch1.4.0
ORsunjdkMatch1.4.0_01
ORsunjdkMatch1.4.0_02
ORsunjdkMatch1.4.0_03
ORsunjdkMatch1.4.0_04
ORsunjdkMatch1.4.1
ORsunjdkMatch1.4.1_01
ORsunjdkMatch1.4.1_02
ORsunjdkMatch1.4.1_03
ORsunjdkMatch1.4.1_04
ORsunjdkMatch1.4.1_05
ORsunjdkMatch1.4.1_06
ORsunjdkMatch1.4.1_07
ORsunjdkMatch1.4.2
ORsunjdkMatch1.4.2_1
ORsunjdkMatch1.4.2_2
ORsunjdkMatch1.4.2_3
ORsunjdkMatch1.4.2_4
ORsunjdkMatch1.4.2_5
ORsunjdkMatch1.4.2_6
ORsunjdkMatch1.4.2_7
ORsunjdkMatch1.4.2_8
ORsunjdkMatch1.4.2_9
ORsunjdkMatch1.4.2_10
ORsunjdkMatch1.4.2_11
ORsunjdkMatch1.4.2_12
ORsunjdkMatch1.4.2_13
ORsunjdkMatch1.4.2_14
ORsunjdkMatch1.4.2_15
ORsunjdkMatch1.4.2_16
ORsunjdkMatch1.4.2_17
ORsunjdkMatch1.4.2_18
ORsunjdkMatch1.4.2_19
ORsunjdkMatch1.5.0
ORsunjdkMatch1.5.0update_1
ORsunjdkMatch1.5.0update_10
ORsunjdkMatch1.5.0update_11
ORsunjdkMatch1.5.0update_12
ORsunjdkMatch1.5.0update_13
ORsunjdkMatch1.5.0update_14
ORsunjdkMatch1.5.0update_15
ORsunjdkMatch1.5.0update_16
ORsunjdkMatch1.5.0update_17
ORsunjdkMatch1.5.0update_18
ORsunjdkMatch1.5.0update_19
ORsunjdkMatch1.5.0update_2
ORsunjdkMatch1.5.0update_20
ORsunjdkMatch1.5.0update_21
ORsunjdkMatch1.5.0update_3
ORsunjdkMatch1.5.0update_4
ORsunjdkMatch1.5.0update_5
ORsunjdkMatch1.5.0update_6
ORsunjdkMatch1.5.0update_7
ORsunjdkMatch1.5.0update_8
ORsunjdkMatch1.5.0update_9
ORsunjdkMatch1.5.0update1
ORsunjdkMatch1.5.0update10
ORsunjdkMatch1.5.0update11
ORsunjdkMatch1.5.0update11_b03
ORsunjdkMatch1.5.0update12
ORsunjdkMatch1.5.0update13
ORsunjdkMatch1.5.0update14
ORsunjdkMatch1.5.0update15
ORsunjdkMatch1.5.0update16
ORsunjdkMatch1.5.0update17
ORsunjdkMatch1.5.0update18
ORsunjdkMatch1.5.0update19
ORsunjdkMatch1.5.0update2
ORsunjdkMatch1.5.0update20
ORsunjdkMatch1.5.0update21
ORsunjdkMatch1.5.0update22
ORsunjdkMatch1.5.0update23
ORsunjdkMatch1.5.0update24
ORsunjdkMatch1.5.0update25
ORsunjdkMatch1.5.0update3
ORsunjdkMatch1.5.0update4
ORsunjdkMatch1.5.0update5
ORsunjdkMatch1.5.0update6
ORsunjdkMatch1.5.0update7
ORsunjdkMatch1.5.0update7_b03
ORsunjdkMatch1.5.0update8
ORsunjdkMatch1.5.0update9
ORsunjdkMatch1.5.0_03solaris
ORsunjdkMatch1.5.0_03windows
springsourcedm_serverMatch1.0.0
ORspringsourcedm_serverMatch1.0.1
ORspringsourcedm_serverMatch1.0.2
ORspringsourcespring_frameworkMatch1.1.0
ORspringsourcespring_frameworkMatch2.0
ORspringsourcespring_frameworkMatch2.0m1
ORspringsourcespring_frameworkMatch2.0m2
ORspringsourcespring_frameworkMatch2.0m3
ORspringsourcespring_frameworkMatch2.0m4
ORspringsourcespring_frameworkMatch2.0m5
ORspringsourcespring_frameworkMatch2.0rc1
ORspringsourcespring_frameworkMatch2.0rc2
ORspringsourcespring_frameworkMatch2.0rc3
ORspringsourcespring_frameworkMatch2.0rc4
ORspringsourcespring_frameworkMatch2.0.1
ORspringsourcespring_frameworkMatch2.0.2
ORspringsourcespring_frameworkMatch2.0.3
ORspringsourcespring_frameworkMatch2.0.4
ORspringsourcespring_frameworkMatch2.0.5
ORspringsourcespring_frameworkMatch2.1m1
ORspringsourcespring_frameworkMatch2.1m2
ORspringsourcespring_frameworkMatch2.1m3
ORspringsourcespring_frameworkMatch2.1m4
ORspringsourcespring_frameworkMatch2.5.0
ORspringsourcespring_frameworkMatch2.5.0rc1
ORspringsourcespring_frameworkMatch2.5.0rc2
ORspringsourcespring_frameworkMatch2.5.1
ORspringsourcespring_frameworkMatch2.5.2
ORspringsourcespring_frameworkMatch2.5.3
ORspringsourcespring_frameworkMatch2.5.4
ORspringsourcespring_frameworkMatch2.5.5
ORspringsourcespring_frameworkMatch2.5.6
ORspringsourcespring_frameworkMatch3.0.0m1
ORspringsourcespring_frameworkMatch3.0.0m2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sun | jdk | * | cpe:2.3:a:sun:jdk:*:update_22:*:*:*:*:*:* |
| sun | jdk | 1.1.0 | cpe:2.3:a:sun:jdk:1.1.0:*:*:*:*:*:*:* |
| sun | jdk | 1.1.6 | cpe:2.3:a:sun:jdk:1.1.6:*:*:*:*:*:*:* |
| sun | jdk | 1.1.6 | cpe:2.3:a:sun:jdk:1.1.6:update7:*:*:*:*:*:* |
| sun | jdk | 1.1.7b | cpe:2.3:a:sun:jdk:1.1.7b:*:*:*:*:*:*:* |
| sun | jdk | 1.1.7b | cpe:2.3:a:sun:jdk:1.1.7b:update5:*:*:*:*:*:* |
| sun | jdk | 1.1.8 | cpe:2.3:a:sun:jdk:1.1.8:update10:*:*:*:*:*:* |
| sun | jdk | 1.1.8 | cpe:2.3:a:sun:jdk:1.1.8:update13:*:*:*:*:*:* |
| sun | jdk | 1.1.8 | cpe:2.3:a:sun:jdk:1.1.8:update14:*:*:*:*:*:* |
| sun | jdk | 1.1.8 | cpe:2.3:a:sun:jdk:1.1.8:update2:*:*:*:*:*:* |
References
Related
cvelist
cvelist
CVE-2009-1190
2009-04-27 22:00:00
CVE-2004-2540
2005-11-16 07:37:00
ubuntucve
ubuntucve
CVE-2009-1190
2009-04-27 00:00:00
prion
prion
Design/Logic Flaw
2009-04-27 22:30:00
cve
cve
CVE-2009-1190
2009-04-27 22:30:00
CVE-2004-2540
2005-11-16 07:37:00
osv
osv
Spring Framework Inefficient Regular Expression Complexity
2022-05-02 03:22:35
github
github
Spring Framework Inefficient Regular Expression Complexity
2022-05-02 03:22:35
nvd
nvd
CVE-2004-2540
2004-12-31 05:00:00
ibm
ibm
Security Bulletin: Multiple CVEs affect IBM Integration Designer
2023-02-01 19:40:57
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
AI Score
9.2
Confidence
High
EPSS
0.278
Percentile
96.9%
Related for NVD:CVE-2009-1190