CVE-2022-33879

    Dashboard / Vulnerabilities / CVE-2022-33879

    CVE-2022-33879

    Published: 27 Jun 2022Last Modified: 12 Aug 2026

    Summary: Incomplete fix and new regex DoS in StandardsExtractingContentHandler

    Details: The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.

    References: https://lists.apache.org/thread/wfno8mf5nlcvbs78z93q9thgrm30wwfh, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33879.json, https://nvd.nist.gov/vuln/detail/CVE-2022-33879, https://security.netapp.com/advisory/ntap-20220812-0004/, http://www.openwall.com/lists/oss-security/2022/06/27/5

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2486c832d7b72127b8d48699ae38f6282107d115

    Affected versions

    1.28.3
    1.28.2
    1.28.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-33879 | CVE-DB