| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| nautobot | ≥ 3.0.0, < 3.1.2≥ 3.0.0a2, < 3.1.2< 2.4.33 | 3.1.22.4.33 |
| nautobot | ≥ 3.0.0, < 3.1.2< 2.4.33 | 3.1.22.4.33 |
Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag.
A general-purpose timeout has been added to these endpoints in Nautobot v2.4.33 and v3.1.2, which ensures that the request will fail early with an appropriate message if regular expression evaluation takes more than a short period of time, instead of continuing to execute for an indefinite duration.
No known workaround has been identified at this time.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン