Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact What kind of vulnerability is it? Who is impacted? This is an advisory for a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl's DataSource mechanism. When the listNames(String regex) method is called on a DataSource, the user-supplied regular expression (which may be unvalidated) is compiled and evaluated against a collection of file-like resource names. To trigger a polynomial ReDoS via this mechanism, two attacker-controlled conditions must be met: - Control over the regex input passed into listNames(String regex). - Example: An attacker supplies a malicious pattern like (.a){10000}. - Control or influence over the file/resource names being matched. - Example: Filenames such as "aaaa...!" that induce regex engine backtracking. If both conditions are satisfied, a malicious actor can cause significant CPU consumption due to regex backtracking — even with polynomial patterns. Since both inputs can be controlled via a publicly…
Recommended action: Upgrade to 6.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? In certain places, powsybl-core XML parsing is vulnerable to an XXE attack and in on place also to an SSRF attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. Am I impacted? You are vulnerable if you allow untrusted users to import untrusted CGMES or XIIDM network files. Patches com.powsybl:powsybl-commons:6.7.2 and higher References powsybl-core v6.7.2
Recommended action: Upgrade to 6.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.