PT-2022-6598 · Atlassian+8 · Confluence+8
Published
2022-02-06
·
Updated
2026-06-04
·
CVE-2022-3517
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
minimatch versions 7.19.0 and earlier
Confluence Data Center versions prior to 9.1.0
Description
A vulnerability was found in the minimatch package, allowing a Regular Expression Denial of Service (ReDoS) when calling the
braceExpand function with specific arguments, resulting in a Denial of Service. This flaw can be exploited by a remote attacker to perform a Denial of Service attack using regular expressions. The issue has a high impact on availability and requires no user interaction.Recommendations
For minimatch versions 7.19.0 and earlier, consider disabling the
braceExpand function as a temporary workaround until a patch is available.
For Confluence Data Center versions prior to 9.1.0, upgrade to a release greater than or equal to 9.1.0 to resolve the issue.Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Confluence
Linuxmint
Red Hat
Red Os
Rocky Linux
Ubuntu