Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-41715
HistoryOct 14, 2022 - 12:00 a.m.

CVE-2022-41715

2022-10-1400:00:00
ubuntu.com
ubuntu.com
25
cve-2022-41715
memory exhaustion
denial of service
regular expressions
unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

60.1%

Programs which compile regular expressions from untrusted sources may be
vulnerable to memory exhaustion or denial of service. The parsed regexp
representation is linear in the size of the input, but in some cases the
constant factor can be as high as 40,000, making relatively small regexps
consume much larger amounts of memory. After fix, each regexp being parsed
is limited to a 256 MB memory footprint. Regular expressions whose
representation would use more space than that are rejected. Normal use of
regular expressions is unaffected.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

60.1%