CVE-2019-16215: Medium severity zulip server vulnerability
The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-16215?
CVE-2019-16215 is a vulnerability in Zulip server before 2.0.5 that allows a crafted message to stall the processing of future messages.
What is the severity of CVE-2019-16215?
CVE-2019-16215 has a severity rating of 6.5 (Medium).
How does CVE-2019-16215 affect Zulip server?
CVE-2019-16215 affects Zulip server versions up to and excluding 2.0.5.
How can I fix CVE-2019-16215?
To fix CVE-2019-16215, upgrade your Zulip server to version 2.0.5 or higher.
Where can I find more information about CVE-2019-16215?
You can find more information about CVE-2019-16215 in the Zulip blog post and the GitHub commit linked in the references section.