Main Vulnerability Database Vulnerabilities #VU84090

Inefficient regular expression complexity in zod - CVE-2023-4316

Published: December 12, 2023

Vulnerability identifier: #VU84090

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4316

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Affected software

zod
IBM Cloud Pak for Watson AIOps

How to mitigate CVE-2023-4316

Install updates from vendor's website.

zod - update to 3.22.3

External References

Related Security Bulletins