Description
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jline jline3
>= 3.0.0, < 3.30.15affected>= 4.0.0, < 4.3.1affected
References
- https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw ↗
- https://github.com/jline/jline3/pull/2012 ↗
- https://github.com/jline/jline3/pull/2018 ↗
- https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541 ↗
- https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae ↗
- https://github.com/jline/jline3/releases/tag/4.3.1 ↗
- https://github.com/jline/jline3/releases/tag/jline-3.30.15 ↗