Homepage

Inefficient Regular Expression Complexity The advisory has been revoked - it doesn't affect any version of package ckeditor3  (opens in a new tab)

Threat Intelligence

EPSS
0.67% (80th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN13-CKEDITOR3-5678145
  • published25 Mar 2022
  • disclosed16 Mar 2022
Report a new vulnerability Found a mistake?

Introduced: 16 Mar 2022

CVE-2022-24729  (opens in a new tab)
CWE-1333  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:13.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ckeditor3 package and not the ckeditor3 package as distributed by Debian.

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

References