CVE-2022-43766
CVE-2022-43766 · Apache IoTDB prior to 0.13.3 allows DoS
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to avoid it.
CVSS 7.5 · High · EPSS 1.6% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
apache iotdb
- Versions
- ≥ unspecified, ≤ 0.13.2: Affected (custom)
- ≥ 0.12.2, < unspecified: Affected (custom)
No fix published
org.apache.iotdb:flink-tsfile-connector Maven
- Versions
- 0.12.2
- 0.12.3
- 0.12.4
- 0.12.5
- 0.12.6
- 0.13.0
- 0.13.1
- 0.13.2
- Affected ranges
- ECOSYSTEM: ≥ 0.12.2, < 0.13.3
Update to 0.13.3
apache-iotdb PyPI
- Versions
- 0.12.2
- 0.12.3
- 0.12.4
- 0.12.5
- 0.12.6
- 0.13.0
- 0.13.0.post1
- 0.13.1
- 0.13.2
- Affected ranges
- ECOSYSTEM: ≥ 0.12.2, < 0.13.3
Update to 0.13.3
org.apache.iotdb:iotdb-server Maven
- Versions
- 0.12.2
- 0.12.3
- 0.12.4
- 0.12.5
- 0.12.6
- 0.13.0
- 0.13.1
- 0.13.2
- Affected ranges
- ECOSYSTEM: ≥ 0.12.2, < 0.13.3
Update to 0.13.3
org.apache.iotdb:tsfile Maven
- Versions
- 0.12.2
- 0.12.3
- 0.12.4
- 0.12.5
- 0.12.6
- 0.13.0
- 0.13.1
- 0.13.2
- Affected ranges
- ECOSYSTEM: ≥ 0.12.2, < 0.13.3
Update to 0.13.3