IBM Engineering Lifecycle Optimization - Publishing Denial-of-Service Vulnerability via Complex Regular Expressions

A denial-of-service vulnerability has been identified in IBM Engineering Lifecycle Optimization - Publishing versions 7.0.2 and 7.0.3. This issue allows remote attackers to disrupt service by exploiting inefficient regular expression processing, which can lead to catastrophic backtracking and event loop blocking in server-side environments like Node.js.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition, where the application becomes unresponsive due to prolonged processing of crafted input by a complex regular expression.

Remediation

Users can upgrade to IBM Engineering Lifecycle Optimization - Publishing version 7.0.3 iFix010 or later, or version 7.0.2 iFix032 or later, to address this vulnerability.