GHSA-rwrx-x2hw-9h5w

Source

https://github.com/advisories/GHSA-rwrx-x2hw-9h5w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-rwrx-x2hw-9h5w/GHSA-rwrx-x2hw-9h5w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rwrx-x2hw-9h5w

Aliases

CVE-2023-26513

Published

2023-03-20T15:30:20Z

Modified

2023-11-08T04:12:02.581196Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Apache Sling Resource Merger has Excessive Iteration vulnerability

Details

Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger. This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2.

Database specific

{
    "cwe_ids": [
        "CWE-834"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-20T17:28:36Z",
    "nvd_published_at": "2023-03-20T13:15:00Z",
    "severity": "HIGH"
}

References

Affected packages

Maven / org.apache.sling:org.apache.sling.resourcemerger

Package

Name: org.apache.sling:org.apache.sling.resourcemerger; View open source insights on deps.dev
Purl: pkg:maven/org.apache.sling/org.apache.sling.resourcemerger

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.2.0

Fixed

1.4.2

Affected versions

1.*

1.2.0

1.2.4

1.2.6

1.2.8

1.2.10

1.3.0

1.3.2

1.3.4

1.3.6

1.3.8

1.3.10

1.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-rwrx-x2hw-9h5w/GHSA-rwrx-x2hw-9h5w.json"