CVE-2023-25822: Denial of Service Vulnerability in com.epam.reportportal:service-api
Summary
CVE-2023-25822: Impact ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1 test inside when the test_item.path field is exceeded the allowable "ltree" field type indexin... Affects com.epam.reportportal:service-api versions < 5.10.0. Fixed in 5.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.epam.reportportal:service-api package is a Maven package that is part of the ReportPortal project. ReportPortal is a reporting tool that provides a centralized platform for managing and analyzing test results. The service-api module is responsible for handling API requests and managing the database. This vulnerability affects versions prior to 5.10.0 of the service-api module.
Vulnerability Detail
This vulnerability allows an attacker to cause a denial of service (DoS) by creating a Launch with too many recursively nested elements in ReportPortal. When the test_item.path field exceeds the allowable "ltree" field type indexing limit (path length >= 120 approximately), the ReportPortal database becomes unstable and reporting almost fully stops. Reindexing the path_gist_idx and path_idx indexes does not resolve the issue. The impact of this vulnerability is that the database becomes unstable and reporting is severely affected.
How To Fix
Minimum fixed version
5.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a workaround is to delete the data with long paths from the database and reindex both the path_gist_idx and path_idx indexes. This will stabilize the database and restore proper functionality to ReportPortal.
Conclusion
In conclusion, the com.epam.reportportal:service-api package is vulnerable to a denial of service (DoS) vulnerability when creating a Launch with too many recursively nested elements. This vulnerability can be fixed by upgrading to version 5.10.0 of the package or applying the provided workaround. It is recommended to take appropriate measures to secure the ReportPortal database and ensure the stability of the reporting functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.epam.reportportal:service-api →
FAQ
The impact of this vulnerability is that the ReportPortal database becomes unstable and reporting is severely affected. Only launches with approximately 1 test inside will continue to work properly.
To fix this vulnerability, upgrade to version 5.10.0 of the com.epam.reportportal:service-api package.
Yes, if upgrading to the fixed version is not immediately possible, you can delete the data with long paths from the database and reindex the path_gist_idx and path_idx indexes.
There is a risk of data loss when deleting the data with long paths from the database. It is recommended to backup the database before performing any modifications.
You can find more information about the fix in the release notes of version 5.10.0 of the com.epam.reportportal:service-api package. The vulnerability details are also available in the GitHub Advisory Database.
Related vulnerabilities
Recent vulnerabilities recorded for com.epam.reportportal:service-api.
