-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure handling of user-supplied regex patterns in REGEXP queries using Java 8's regex engine, leading to ReDoS. However, the provided information lacks concrete code references, commit diffs, or specific function names from Apache IoTDB's codebase. While the vulnerability context strongly suggests regex processing functions (e.g., Pattern.matches() or query parsing methods) are involved, the absence of patch details or explicit function/file references in advisories prevents high-confidence identification of exact vulnerable functions. The fix in v0.13.3 likely involves regex validation or engine changes, but this cannot be confirmed without code analysis.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.iotdb:flink-tsfile-connector | maven | >= 0.12.2, < 0.13.3 | 0.13.3 |
| apache-iotdb | pip | >= 0.12.2, < 0.13.3 | 0.13.3 |
| org.apache.iotdb:iotdb-server | maven | >= 0.12.2, < 0.13.3 | 0.13.3 |
| org.apache.iotdb:tsfile | maven | >= 0.12.2, < 0.13.3 | 0.13.3 |