PT-2023-20327 · Unknown · Reportportal

Hardnorth · Publicado 2023-10-09 · Atualizado 2023-10-13 · CVE-2023-25822

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions ReportPortal versions prior to 5.10.0

Description The ReportPortal database becomes unstable and reporting almost fully stops when the test item.path field exceeds the allowable ltree field type indexing limit, which occurs when the path length is greater than or equal to 120 or when there is recursive nesting of nested steps. REINDEX INDEX path gist idx and path idx does not resolve the issue. The problem was fixed by programmatically limiting the maximum number of nested elements.

Recommendations For versions prior to 5.10.0, delete the data with long paths and reindex both indexes (path gist idx and path idx) to stabilize the database and ensure ReportPortal works properly. Update to com.epam.reportportal:service-api module version 5.10.0 (product release 23.2) where the maximum number of nested elements were programmatically limited.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2023-25822

GHSA-MJ24-GPW7-23M9

Produtos afetados

Reportportal

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25822.json · Exploit
• https://github.com/reportportal/reportportal/releases/tag/v23.2 · Nota
• https://github.com/reportportal/reportportal/security/advisories/GHSA-mj24-gpw7-23m9 · Aviso do Fabricante
• https://github.com/reportportal/reportportal · Nota
• https://t.me/cibsecurity/71843 · Publicação no Telegram
• https://reportportal.io/docs/releases/Version23.2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25822 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25822 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mj24-gpw7-23m9 · Aviso do Fabricante