Описание
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
[DISPUTED] A vulnerability was found in the ParseTools.subCompileExpression() method in the Mvel package. This vulnerability manifests as a TimeOut error, and may allow an attacker to leverage the TimeOut error to disrupt the normal functioning of the system or application, potentially leading to undesired outcomes or disruptions.
Отчет
This CVE is disputed because the only anticipated outcome is that the parser will take an exceptionally long time to complete its task.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Serverless | mvel | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 3 | mvel | Not affected | ||
| Red Hat Build of Keycloak | mvel | Not affected | ||
| Red Hat build of OptaPlanner 8 | mvel | Not affected | ||
| Red Hat build of Quarkus | org.mvel/mvel2 | Not affected | ||
| Red Hat Data Grid 8 | mvel | Not affected | ||
| Red Hat Decision Manager 7 | mvel | Not affected | ||
| Red Hat Fuse 7 | mvel | Not affected | ||
| Red Hat Integration Camel K 1 | mvel | Not affected | ||
| Red Hat JBoss Data Grid 7 | mvel | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
mvel2 TimeOut error exists in the ParseTools.subCompileExpression method
EPSS
5.3 Medium
CVSS3