Your submission was sent successfully! Close

CVE-2022-24729

Published: 16 March 2022

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Notes

AuthorNote
sbeattie
embedded copies of ckeditor are in ldap-account-manager,
rt4, and rt5
Priority

Low

CVSS 3 base score: 7.5

Status

Package Release Status
ckeditor
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

impish Ignored
(reached end-of-life)
jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(out of standard support)
ckeditor3
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

impish Ignored
(reached end-of-life)
jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(out of standard support)
ldap-account-manager
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

impish Ignored
(reached end-of-life)
jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(out of standard support)
request-tracker4
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

impish Ignored
(reached end-of-life)
jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(out of standard support)