Skip to content

DoS vulnerability on creating a Launch with too many recursively nested elements

Moderate
HardNorth published GHSA-mj24-gpw7-23m9 Oct 9, 2023

Package

maven com.epam.reportportal:service-api (Maven)

Affected versions

< 5.8

Patched versions

>= 5.10

Description

Impact

ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1 test inside when the test_item.path field is exceeded the allowable "ltree" field type indexing limit (path length>=120 approximately, recursive nesting of the nested steps).

REINDEX INDEX path_gist_idx and path_idx aren't helped.

Patches

The problem was fixed in service-api module of version 5.10.0 (product release 23.2), where the maximum number of nested elements were programmatically limited.

Workarounds

After deletion of the data with long paths, and reindexing both indexes (path_gist_idx and path_idx), the database becomes stable and ReportPortal is working properly.

Severity

Moderate
6.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H

CVE ID

CVE-2023-25822

Weaknesses

No CWEs