In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• octopus octopus server0.9 and later · up to 0.9.620.4 inclusive
• octopus octopus server1.0 and later · up to 1.6.3.1723 inclusive
• octopus octopus server2.0 and later · up to 2.6.5 inclusive
• octopus octopus server3.0.0 and later · up to 3.17.14 inclusive
• octopus octopus server4.0.4 and later · up to 4.1.10 inclusive
• octopus octopus server2018.1.0 and later · up to 2018.12.1 inclusive
• octopus octopus server2019.1.0 and later · up to 2019.13.7 inclusive
• octopus octopus server2020.1.0 and later · up to 2020.6.5449 inclusive
• octopus octopus server2021.1.6959 and later · up to 2021.3.13021 inclusive
• octopus octopus server2022.1.0 and later · before 2022.1.2894
• octopus octopus server2022.2.6729 and later · before 2022.2.6872
• octopus octopus server2022.3.348 and later · before 2022.3.4953

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Octopus). Independent of NVD's CPE analysis and usually ahead of it.

• Octopus Deploy Octopus Server

  • 0.9 and later · before unspecifiedaffected
  • unspecified and later · before 2022.1.2894affected
  • 2022.2.6729 and later · before unspecifiedaffected
  • unspecified and later · before 2022.2.6872affected
  • 2022.3.348 and later · before unspecifiedaffected
  • unspecified and later · before 2022.3.4953affected

Other highest-scoring records for the same primary product.

• CVE-2022-2572In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys
  39Monitor
• CVE-2022-2778In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
  39Monitor
• CVE-2018-18850In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could uplo
  39Monitor
• CVE-2018-11320In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in t
  39Monitor
• CVE-2022-2782In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session
  36Monitor
• CVE-2022-4009In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.