CVE-2022-33879: Inefficient Regular Expression Complexity

June 27, 2022 (updated October 28, 2022)

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.

References

www.openwall.com/lists/oss-security/2022/06/27/5
lists.apache.org/thread/wfno8mf5nlcvbs78z93q9thgrm30wwfh
nvd.nist.gov/vuln/detail/CVE-2022-33879

Code Behaviors & Features

Detect and mitigate CVE-2022-33879 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →