CVE-2019-16215

Опубликовано: 18 сент. 2019

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages.

Ссылки

https://blog.zulip.org/2019/09/11/zulip-server-2-0-5-security-release/
Vendor Advisory
https://github.com/zulip/zulip/commit/5797f013b3be450c146a4141514bda525f2f1b51
Patch
Third Party Advisory
https://blog.zulip.org/2019/09/11/zulip-server-2-0-5-security-release/
Vendor Advisory
https://github.com/zulip/zulip/commit/5797f013b3be450c146a4141514bda525f2f1b51
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*

Версия до 2.0.5 (исключая)

EPSS

Процентиль: 65%

0.00488

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-1333

Связанные уязвимости

CVE-2019-16215

CVSS3: 6.5

debian

больше 6 лет назад

The Markdown parser in Zulip server before 2.0.5 used a regular expres ...

GHSA-mmx6-xv2h-w7x8

CVSS3: 6.5

github

больше 3 лет назад

EPSS

Процентиль: 65%

0.00488

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-1333