CVE-2020-14177 Denial of service in Jira Server

Medium 6.5 Published 21 Sep 2020 Updated 17 Sep 2024

Remote attackers can cause a Denial of Service in Atlassian Jira Server via Regex-based DoS in JQL version searching.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-14177?

CVE-2020-14177 is a medium-severity denial of service vulnerability in Atlassian Jira Server, published on 21 Sep 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from version 8.6.0 before 8.10.2; and from version 8.11.0 before 8.11.1.

Which versions are affected by CVE-2020-14177?

It affects 1 product.

Products include Atlassian Jira Server.

How do I fix CVE-2020-14177?

No fix has been published for CVE-2020-14177 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-14177 being exploited?

There is no known exploitation of CVE-2020-14177 in the wild and no public exploit code.

All Atlassian Jira Server vulnerabilities

Sources

Also known as GHSA-rwmh-92fw-c49r.