Description

Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.

Remediation

References

https://lists.apache.org/thread/hwnw7xr969sg5nv84wz75nfr2c76fl93

Related Vulnerabilities

CVE-2013-4590 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-jasper

CVE-2022-4116 Vulnerability in maven package io.quarkus:quarkus-vertx-http-deployment

CVE-2019-10357 Vulnerability in maven package org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

CVE-2020-4077 Vulnerability in maven package org.webjars.npm:electron

CVE-2021-21193 Vulnerability in maven package org.webjars.npm:electron

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Mailing List Vendor Advisory NVD-CWE-noinfo