PT-2022-27026 · Apache · Apache Iotdb

4Ra1N Of + 1 · Published 2022-10-26 · Updated 2025-05-07 · CVE-2022-43766

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 0.12.2 through 0.12.6 Apache IoTDB versions 0.13.0 through 0.13.2

Description The issue is a Denial of Service attack that occurs when Apache IoTDB accepts untrusted patterns for REGEXP queries with Java 8. Users can avoid this issue by upgrading to version 0.13.3 or using a later version of Java.

Recommendations For Apache IoTDB versions 0.12.2 through 0.12.6, upgrade to version 0.13.3 or use a later version of Java to avoid the Denial of Service attack. For Apache IoTDB versions 0.13.0 through 0.13.2, upgrade to version 0.13.3 or use a later version of Java to avoid the Denial of Service attack.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-43766

GHSA-G6HG-4V3C-6JQ7

PYSEC-2022-42972

Affected Products

Apache Iotdb

References · 8

• https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43766 · Security Note
• https://osv.dev/vulnerability/GHSA-g6hg-4v3c-6jq7 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-42972 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43766 · Vendor Advisory
• https://github.com/apache/iotdb · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml · Note
• https://t.me/cvenotify/121207 · Telegram Post