CVE-2022-43766: Apache IoTDB prior to 0.13.3 allows DoS
First published: Wed Oct 26 2022(Updated: )
Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to avoid it.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache IoTDB | >=0.12.2<=0.12.6 | |
| Apache IoTDB | >=0.13.0<=0.13.2 | |
| maven/org.apache.iotdb:tsfile | >=0.12.2<0.13.3 | 0.13.3 |
| maven/org.apache.iotdb:iotdb-server | >=0.12.2<0.13.3 | 0.13.3 |
| pip/apache-iotdb | >=0.12.2<0.13.3 | 0.13.3 |
| maven/org.apache.iotdb:flink-tsfile-connector | >=0.12.2<0.13.3 | 0.13.3 |
| >=0.12.2<=0.12.6 | ||
| >=0.13.0<=0.13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-43766?
The severity of CVE-2022-43766 is high with a CVSS score of 7.5.
What is the vulnerability ID for Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2?
The vulnerability ID for Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 is CVE-2022-43766.
How can I mitigate the Denial of Service vulnerability in Apache IoTDB?
To mitigate the Denial of Service vulnerability in Apache IoTDB, users should upgrade to version 0.13.3 or use a later version of Java.
What is the affected software for CVE-2022-43766?
The affected software for CVE-2022-43766 is Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2.
Where can I find more information about CVE-2022-43766?
More information about CVE-2022-43766 can be found at this reference: [link](https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn).
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-g6hg-4v3c-6jq7
- alias/CVE-2022-43766
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/nvd-api
- agent/last-modified-date
- agent/trending
- agent/tags
- agent/source
- vendor/apache
- canonical/apache iotdb
- version/apache iotdb/0.12.2
- version/apache iotdb/0.12.6
- version/apache iotdb/0.13.0
- version/apache iotdb/0.13.2
- package-manager/maven
- package-manager/pip