CVE-2022-25598: Uncontrolled Resource Consumption in Apache DolphinScheduler
Summary
CVE-2022-25598: Uncontrolled Resource Consumption in Apache DolphinScheduler. Affects org.apache.dolphinscheduler:dolphinscheduler versions < 2.0.5. Fixed in 2.0.5. How to fix ↓
Also tracked for
- apache-dolphinscheduler · PyPI
The same CVE-2022-25598 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache DolphinScheduler is an open-source distributed workflow scheduling system designed to manage and orchestrate large-scale data processing tasks. It provides a user-friendly interface for defining workflows and managing job execution. The vulnerability identified as CVE-2022-25598 affects the user registration functionality of Apache DolphinScheduler. This vulnerability exposes the system to Regular Expression Denial of Service (ReDoS) attacks, which can lead to uncontrolled resource consumption and potential service disruption.
Vulnerability Detail
The vulnerability arises due to a lack of input validation in the user registration process. An attacker can exploit this by submitting specially crafted input that triggers a ReDoS attack. ReDoS attacks exploit the inefficient matching behavior of regular expressions, causing the system to spend an excessive amount of time processing the input. This can result in high CPU utilization, memory exhaustion, and ultimately, denial of service. The impact of this vulnerability can be severe, leading to service unavailability and disruption of critical workflows.
How To Fix
Minimum fixed version
2.0.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Apache DolphinScheduler's user registration process exposes the system to ReDoS attacks, which can result in uncontrolled resource consumption and potential service disruption. Users are advised to upgrade to version 2.0.5 or higher to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.apache.dolphinscheduler:dolphinscheduler →
FAQ
Apache DolphinScheduler is an open-source distributed workflow scheduling system used for managing and orchestrating large-scale data processing tasks.
The vulnerability allows for Regular Expression Denial of Service (ReDoS) attacks, which can lead to uncontrolled resource consumption and potential service disruption.
To mitigate the risk, it is recommended to upgrade to Apache DolphinScheduler version 2.0.5 or higher, which includes a fix for this vulnerability.
No specific workarounds have been identified for this vulnerability. It is recommended to upgrade to the latest version of Apache DolphinScheduler.
For more information about this vulnerability, you can refer to the official advisory published by Apache DolphinScheduler.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dolphinscheduler:dolphinscheduler.
