PT-2023-20327 · Unknown · Reportportal

Hardnorth · Published 2023-10-09 · Updated 2023-10-13 · CVE-2023-25822

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions ReportPortal versions prior to 5.10.0

Description The ReportPortal database becomes unstable and reporting almost fully stops when the test item.path field exceeds the allowable ltree field type indexing limit, which occurs when the path length is greater than or equal to 120 or when there is recursive nesting of nested steps. REINDEX INDEX path gist idx and path idx does not resolve the issue. The problem was fixed by programmatically limiting the maximum number of nested elements.

Recommendations For versions prior to 5.10.0, delete the data with long paths and reindex both indexes (path gist idx and path idx) to stabilize the database and ensure ReportPortal works properly. Update to com.epam.reportportal:service-api module version 5.10.0 (product release 23.2) where the maximum number of nested elements were programmatically limited.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-25822

GHSA-MJ24-GPW7-23M9

Affected Products

Reportportal

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25822.json · Exploit
• https://github.com/reportportal/reportportal/security/advisories/GHSA-mj24-gpw7-23m9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25822 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25822 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mj24-gpw7-23m9 · Vendor Advisory
• https://github.com/reportportal/reportportal/releases/tag/v23.2 · Note
• https://github.com/reportportal/reportportal · Note
• https://t.me/cibsecurity/71843 · Telegram Post
• https://reportportal.io/docs/releases/Version23.2 · Note