Versio.io

CVE-2022-29169

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 02-06-2022 01:15
Last modified: - 09-06-2022 02:57
Total changes: - 3

Description

BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using `SmartWatch`. The maintainers removed `htmlclient/useragent` from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Low
Attack complexity
Network
Attack vector
High
Availability
None
Confidentiality
None
Integrity
None
Privileges required
Unchanged
Scope
None
User interaction
7.5
Base score
3.9
3.6
Exploitability score
Impact score
 

Verification logic

OR
vendor=bigbluebutton AND product=bigbluebutton AND version=2.5 AND update=alpha1
vendor=bigbluebutton AND product=bigbluebutton AND version=2.5 AND update=beta1
vendor=bigbluebutton AND product=bigbluebutton AND version=2.5 AND update=alpha6
vendor=bigbluebutton AND product=bigbluebutton AND version=2.5 AND update=alpha5
vendor=bigbluebutton AND product=bigbluebutton AND version=2.5 AND update=alpha4
vendor=bigbluebutton AND product=bigbluebutton AND version=2.5 AND update=alpha3
vendor=bigbluebutton AND product=bigbluebutton AND version=2.5 AND update=alpha2
vendor=bigbluebutton AND product=bigbluebutton AND versionStartIncluding=2.2.0 AND versionEndExcluding=2.3.19
vendor=bigbluebutton AND product=bigbluebutton AND versionStartIncluding=2.4.0 AND versionEndExcluding=2.4.7
 

Reference

 


Keywords

NVD

 

CVE-2022-29169

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.