JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions.
This issue is fixed in versions 3.30.15 and 4.3.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 7
https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541
security-advisories@github.com
https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae
security-advisories@github.com
https://github.com/jline/jline3/pull/2012
security-advisories@github.com
https://github.com/jline/jline3/pull/2018
security-advisories@github.com
https://github.com/jline/jline3/releases/tag/4.3.1
security-advisories@github.com
https://github.com/jline/jline3/releases/tag/jline-3.30.15
security-advisories@github.com
https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw
security-advisories@github.com