CVE-2022-23548

2023-01-0519:15:09

Google

osv.dev

discourse

redos

version 2.8.14

version 2.9.0.beta16

vulnerability

software

0.0005 Low

EPSS

Percentile

17.7%

JSON

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 2.9.0.beta16 on the beta and tests-passed branches, parsing posts can be susceptible to regular expression denial of service (ReDoS) attacks. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.

CPENameOperatorVersion
discourseeq2.0.0.beta9
discourseeq1.4.0.beta10
discourseeq1.4.0.beta9
discourseeq1.5.1
discourseeq2.0.4
discourseeq2.7.2
discourseeq0.8.7
discourseeq2.4.0.beta7
discourseeq1.5.0.beta5
discourseeq2.5.5

Name	Operator	Version
discourse	eq	2.0.0.beta9
discourse	eq	1.4.0.beta10
discourse	eq	1.4.0.beta9
discourse	eq	1.5.1
discourse	eq	2.0.4
discourse	eq	2.7.2
discourse	eq	0.8.7
discourse	eq	2.4.0.beta7
discourse	eq	1.5.0.beta5
discourse	eq	2.5.5