CVE-2023-7279CWE-1333

CVE-2023-7279

Low · published September 2, 2024

CVSS v3.1
2.6
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

A vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of the file connaisseur/res/targets_schema.json of the component Delegation Name Handler. The manipulation leads to inefficient regular expression complexity. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 524b73ff7306707f6d3a4d1e86401479bca91b02. It is recommended to upgrade the affected component.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00537 · 44.4th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2024-09-02T22:15Z
Affected products (1)
ProductVersionsFixed in
securesystems/connaisseur< 3.3.13.3.1
References (5)
https://github.com/sse-secure-systems/connaisseur/commit/524b73ff7306707f6d3a4d1e86401479bca91b02 · [email protected]https://github.com/sse-secure-systems/connaisseur/pull/1407 · [email protected]https://github.com/sse-secure-systems/connaisseur/releases/tag/v3.3.1 · [email protected]https://vuldb.com/?ctiid.276268 · [email protected]https://vuldb.com/?id.276268 · [email protected]
EPSS history
Timeline
  • 02 SEP 14:00Z
    Secure Systems Engineering Connaisseur Delegation Name targets_schema.json redos
    cvelistv5