IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
2.9Düşük

CVE-2025-69873

ajv.js ajv; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Aut… Yayım: (9 ay önce)

Açıklama

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Zayıflık türü (CWE): CWE-1333CWE-400

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
ajv.js ajv < 6.14.0, 7.0.0 – < 8.17.2
ansible automation platform 2.5 —
ansible automation platform 2.6 —
edge manager 1.0 —
edge manager 1.1 —
jboss enterprise application platform eus 7.3 —
network observ optr 1.11 —
openshift 4.14 —
openshift 4.15 —
openshift 4.16 —
openshift 4.17 —
openshift 4.19 —
openshift ai 2.16 —
openshift ai 3.3 —
openshift data foundation 4.18 —
openshift data foundation 4.19 —
openshift data foundation 4.20 —
openshift devspaces 3.27 —
quay 3.14 —
quay 3.15 —
quay 3.16 —
quay 3.9 —
Red Hat Network Observability (NETOBSERV) 1.11.0 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 all versions
Red Hat Red Hat Developer Hub 1.8 all versions
Red Hat Red Hat Developer Hub 1.9 all versions
Red Hat Red Hat Edge Manager 1.0 all versions
Red Hat Red Hat Edge Manager 1.1 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 all versions
Red Hat Red Hat OpenShift AI 2.16 all versions
Red Hat Red Hat OpenShift AI 3.3 all versions
Red Hat Red Hat OpenShift Container Platform 4.14 all versions
Red Hat Red Hat OpenShift Container Platform 4.15 all versions
Red Hat Red Hat OpenShift Container Platform 4.16 all versions
Red Hat Red Hat OpenShift Container Platform 4.17 all versions
Red Hat Red Hat OpenShift Container Platform 4.19 all versions
Red Hat Red Hat Openshift Data Foundation 4.18 all versions
Red Hat Red Hat Openshift Data Foundation 4.19 all versions
Red Hat Red Hat Openshift Data Foundation 4.20 all versions
rhdh 1.8 —
rhdh 1.9 —
satellite 6.18 —

Kaynaklar ve yamalar