CVE-2022-29169
Description
BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using SmartWatch. The maintainers removed htmlclient/useragent from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: >=2.2.0,<2.3.19
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha1:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha2:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha3:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha4:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha5:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha6:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:beta1:*:*:*:*:*:*
- (no CPE)range: prior to 2.3.19, 2.4.7, and 2.5.0-beta.2
- (no CPE)range: >= 2.2, < 2.3.19
Patches
Vulnerability mechanics
References
3- github.com/bigbluebutton/bigbluebutton/pull/14886nvdPatchThird Party Advisory
- github.com/bigbluebutton/bigbluebutton/pull/14896nvdPatchThird Party Advisory
- github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rwrv-p665-4vwpnvdMitigationPatchThird Party Advisory
News mentions
0No linked articles in our index yet.