CVE-2022-3517

Name of the Vulnerable Software and Affected Versions minimatch versions 7.19.0 and earlier Confluence Data Center versions prior to 9.1.0

Description A vulnerability was found in the minimatch package, allowing a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service. This flaw can be exploited by a remote attacker to perform a Denial of Service attack using regular expressions. The issue has a high impact on availability and requires no user interaction.

Recommendations For minimatch versions 7.19.0 and earlier, consider disabling the braceExpand function as a temporary workaround until a patch is available. For Confluence Data Center versions prior to 9.1.0, upgrade to a release greater than or equal to 9.1.0 to resolve the issue.