PT-2022-17983 · Apache · Apache Shenyu

Zhang Yonglun · Published 2022-05-17 · Updated 2023-07-12 · CVE-2022-26650

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache ShenYu (incubating) versions 2.4.0 through 2.4.2

Description The issue arises from the use of Pattern.matches() in RegexPredicateJudge.java, where both parameters are controllable by the user. This allows an attacker to pass in malicious regular expressions and characters, causing resource exhaustion.

Recommendations For versions 2.4.0, 2.4.1, and 2.4.2, update to version 2.4.3 to resolve the issue. As a temporary workaround, consider restricting user input for the conditionData.getParamValue() and realData parameters to prevent malicious regular expressions from being executed.

Fix

Missing Authorization

DoS

Weakness Enumeration

CWE-862

CWE-1333

Related Identifiers

CVE-2022-26650

GHSA-CW56-J3FM-7W57

Affected Products

Apache Shenyu

References · 7

• http://openwall.com/lists/oss-security/2022/05/17/3 · Patch
• https://lists.apache.org/thread/8rp33m3nm4bwtx3qx76mqynth3t3d673 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26650 · Security Note
• https://osv.dev/vulnerability/GHSA-cw56-j3fm-7w57 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26650 · Vendor Advisory
• https://github.com/apache/incubator-shenyu · Note
• https://t.me/cibsecurity/42799 · Telegram Post