CVE-2022-2049: High severity octopus deploy vulnerability
Published Aug 19, 2022
·Updated
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.
Affected Software
14 affected components
Octopus Octopus Server>=0.9<=0.9.620.4
Octopus Octopus Server>=1.0<=1.6.3.1723
Octopus Octopus Server>=2.0<=2.6.5
Octopus Octopus Server>=3.0.0<=3.17.14
Octopus Octopus Server>=4.0.4<=4.1.10
Octopus Octopus Server>=2018.1.0<=2018.12.1
Octopus Octopus Server>=2019.1.0<=2019.13.7
Octopus Octopus Server>=2020.1.0<=2020.6.5449
Octopus Octopus Server>=2021.1.6959<=2021.3.13021
Octopus Octopus Server>=2022.1.0<2022.1.2894
Octopus Octopus Server>=2022.2.6729<2022.2.6872
Octopus Octopus Server>=2022.3.348<2022.3.4953
Linux Linux kernel
Microsoft Windows
Remediation
Patch Available
Event History
Aug 19, 2022
CVE Published
via MITRE·08:45 AM
Data Sourced
via MITRE·08:45 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-2049?
The severity of CVE-2022-2049 is considered high due to its potential for denial of service through regex processing.
2
How do I fix CVE-2022-2049?
To fix CVE-2022-2049, update Octopus Deploy to a version that is not affected by this vulnerability.
3
Which versions of Octopus Deploy are affected by CVE-2022-2049?
CVE-2022-2049 affects Octopus Deploy versions up to 2022.3.348 but not including 2022.3.4953.
4
What impact does CVE-2022-2049 have on Octopus Deploy?
CVE-2022-2049 allows an attacker to exploit the package upload function, leading to a denial of service.
5
Is there a workaround for CVE-2022-2049?
There are no known effective workarounds for CVE-2022-2049; updating to a patched version is recommended.