JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread.
This issue is fixed in versions 3.30.15 and 4.3.1.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
jline:jline3
References 7
https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541
security-advisories@github.com
https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae
security-advisories@github.com
https://github.com/jline/jline3/pull/2012
security-advisories@github.com
https://github.com/jline/jline3/pull/2018
security-advisories@github.com
https://github.com/jline/jline3/releases/tag/4.3.1
security-advisories@github.com
https://github.com/jline/jline3/releases/tag/jline-3.30.15
security-advisories@github.com
https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3
security-advisories@github.com