Description
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nautobot nautobot
>= 3.0.0a2, < 3.1.2affected< 2.4.33affected
References
- https://github.com/nautobot/nautobot/security/advisories/GHSA-qrpw-gjvh-x5gm ↗
- https://github.com/nautobot/nautobot/commit/5a30d0916953afbeedd24a784709e762cc3879cd ↗
- https://github.com/nautobot/nautobot/commit/c2b766966d814a7141f62c7bc90c85fefb7892ee ↗
- https://github.com/nautobot/nautobot/releases/tag/v2.4.33 ↗
- https://github.com/nautobot/nautobot/releases/tag/v3.1.2 ↗