You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@ignite.apache.org by Ilya Shishkov <sh...@gmail.com> on 2025/09/11 06:19:34 UTC
Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
The memory leak described in sonatype-2021-4292 was fixed a long time
ago, but could you provide more details about the affected versions
and specific lines of code?
пн, 25 авг. 2025 г. в 16:39, João Lola <jo...@hexa-consulting.pt>:
>
> Hello,
>
> I am currently analyzing my security reports for my Apache ignite 2.17 application and I got notify of these security vulnerabilities in said reports:
>
> sonatype-2021-4292 category 9 threat:
>
>
> The ignite-core package is vulnerable to Memory Leak. The readFrom() method in the ClientMessage class prematurely allocates a buffer before validating the size in the handshake's header and fails to release the reserved space when the header is invalid. This causes the system to eventually run out of memory. A remote attacker can exploit this vulnerability by sending several malformed messages to initiate connections provoking a Denial of Service (DoS) condition in the server.
>
> Advisory Deviation Notice: The Sonatype security research team discovered that the read() method in the GridNioServerBuffer class, also has the vulnerable portion of code in it and was not taken into account in the fix.
>
> sonatype-2022-5219 category 7 threat:
>
>
> The ignite-core package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The translateSqlWildcardsToRegex method in the SqlListenerUtils class uses an unsafe regular expression to parse table names and replace wildcard patterns within SQL queries processed with Ignite's JDBC driver. An attacker with the ability to influence table names passed to function calls via the JDBC driver may exploit this vulnerability to exhaust system resources. This will result in a DoS condition.
>
> Are you guys aware of these vulnerabilities? Because these sonatype-type warnings are usually ignored or dismissed.
>
> Do they represent a possible weakness? Or should I discard them, because it's a case of false positive scenario?
>
> Best Regards | Com os melhores cumprimentos,
> João Lola
RE: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Posted by João Lola <jo...@hexa-consulting.pt>.
Hello Ilya,
Thank you for confirm that this is indeed a false positive. I needed evidence to present to security team regarding these vulnerabilities.
Best Regards | Com os melhores cumprimentos,
João Lola
________________________________
De: Ilya Shishkov <sh...@gmail.com>
Enviado: 7 de maio de 2026 13:36
Para: user@ignite.apache.org <us...@ignite.apache.org>
Assunto: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
"sonatype-2021-4292" looks false positive:
> The readFrom() method in the ClientMessage class prematurely allocates a buffer before validating the size in the handshake's header and fails to release the reserved space when the header is invalid
Above description is wrong. This problem was fixed in 2.13 [1]. In fact, size is checked, also we check the type of header. [2, 3]
> Advisory Deviation Notice: The Sonatype security research team discovered that the read() method in the GridNioServerBuffer class, also has the vulnerable portion of code in it and was not taken into account in the fix.
`GridNioServerBuffer` is used only in tests and examples. This class has no effect on the `ignite-core` module.
Links:
1. https://issues.apache.org/jira/browse/IGNITE-15921
2. https://github.com/apache/ignite/commit/85bb788bc6ab21668124fe07bee3d984752bc2c5#diff-c309c609b1d06f48b2ba18e3ed3f676150074f3597d72dfd7f3b248aaa082d3aR157
3. https://github.com/apache/ignite/commit/85bb788bc6ab21668124fe07bee3d984752bc2c5#diff-c309c609b1d06f48b2ba18e3ed3f676150074f3597d72dfd7f3b248aaa082d3aR185
Best regards,
Ilya Shishkov
вт, 5 мая 2026 г. в 16:32, João Lola <jo...@hexa-consulting.pt>>:
Hello,
These vulnerabilities still show up in 2.18. Were they address at all?
Best regards,
João Lola
________________________________
From: João Lola <jo...@hexa-consulting.pt>>
Sent: Tuesday, September 16, 2025 2:19:45 PM
To: user@ignite.apache.org<ma...@ignite.apache.org> <us...@ignite.apache.org>>
Subject: RE: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hello Ilya,
Sorry, but besides what I have already shared here I don´t have anymore information from sonatype about this issue sonatype-2021-4292.
Just these links:
*
https://cwe.mitre.org/data/definitions/401.html
*
https://issues.apache.org/jira/browse/IGNITE-15921
*
https://github.com/apache/ignite/pull/9610
Best Regards | Com os melhores cumprimentos,
João Lola
________________________________
De: Ilya Shishkov <sh...@gmail.com>>
Enviado: 15 de setembro de 2025 15:41
Para: user@ignite.apache.org<ma...@ignite.apache.org> <us...@ignite.apache.org>>
Assunto: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
But I expected more details from sonatype, since the text description does not allow us to determine whether sonatype-2021-4292 is still relevant or not.
Best regards,
Ilya Shishkov
пн, 15 сент. 2025 г. в 16:33, João Lola <jo...@hexa-consulting.pt>>:
Of course, available on GitHub.
Best regards | Com os melhores cumprimentos,
João Lola
________________________________
From: Ilya Shishkov <sh...@gmail.com>>
Sent: Monday, September 15, 2025 10:06:34 AM
To: user@ignite.apache.org<ma...@ignite.apache.org> <us...@ignite.apache.org>>
Subject: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
Where did you take these screenshots?
In the Ignite source code?
Best regards,
Ilya Shishkov
пн, 15 сент. 2025 г. в 11:56, João Lola <jo...@hexa-consulting.pt>>:
Hello Ilya,
Certainly, the lines are 146-211 it's the readFrom() method from ClientMessage class in regards to sonatype-2021-4292.
[cid:ii_19e024b833ccb971f161]
Also, lines 69-114 from read() method inside GridNioServerBuffer class not taken into account in the fix.
[cid:ii_19e024b833dcb971f163]
Regarding to sonatype 2022-5219, its 297-308 its translateSqlWildcardsToRegex() method inside SqlListenerUtils class.
[cid:ii_19e024b833dcb971f162]
Best Regards | Com os melhores cumprimentos,
João Lola
________________________________
De: Ilya Shishkov <sh...@gmail.com>>
Enviado: 11 de setembro de 2025 07:19
Para: user@ignite.apache.org<ma...@ignite.apache.org> <us...@ignite.apache.org>>
Assunto: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
The memory leak described in sonatype-2021-4292 was fixed a long time
ago, but could you provide more details about the affected versions
and specific lines of code?
пн, 25 авг. 2025 г. в 16:39, João Lola <jo...@hexa-consulting.pt>>:
>
> Hello,
>
> I am currently analyzing my security reports for my Apache ignite 2.17 application and I got notify of these security vulnerabilities in said reports:
>
> sonatype-2021-4292 category 9 threat:
>
>
> The ignite-core package is vulnerable to Memory Leak. The readFrom() method in the ClientMessage class prematurely allocates a buffer before validating the size in the handshake's header and fails to release the reserved space when the header is invalid. This causes the system to eventually run out of memory. A remote attacker can exploit this vulnerability by sending several malformed messages to initiate connections provoking a Denial of Service (DoS) condition in the server.
>
> Advisory Deviation Notice: The Sonatype security research team discovered that the read() method in the GridNioServerBuffer class, also has the vulnerable portion of code in it and was not taken into account in the fix.
>
> sonatype-2022-5219 category 7 threat:
>
>
> The ignite-core package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The translateSqlWildcardsToRegex method in the SqlListenerUtils class uses an unsafe regular expression to parse table names and replace wildcard patterns within SQL queries processed with Ignite's JDBC driver. An attacker with the ability to influence table names passed to function calls via the JDBC driver may exploit this vulnerability to exhaust system resources. This will result in a DoS condition.
>
> Are you guys aware of these vulnerabilities? Because these sonatype-type warnings are usually ignored or dismissed.
>
> Do they represent a possible weakness? Or should I discard them, because it's a case of false positive scenario?
>
> Best Regards | Com os melhores cumprimentos,
> João Lola
Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Posted by Ilya Shishkov <sh...@gmail.com>.
Hi,
"sonatype-2021-4292" looks false positive:
> The readFrom() method in the ClientMessage class prematurely allocates a
buffer before validating the size in the handshake's header and fails to
release the reserved space when the header is invalid
Above description is wrong. This problem was fixed in 2.13 [1]. In fact,
size is checked, also we check the type of header. [2, 3]
> Advisory Deviation Notice: The Sonatype security research team discovered
that the read() method in the GridNioServerBuffer class, also has the
vulnerable portion of code in it and was not taken into account in the fix.
`GridNioServerBuffer` is used only in tests and examples. This class has no
effect on the `ignite-core` module.
Links:
1. https://issues.apache.org/jira/browse/IGNITE-15921
2.
https://github.com/apache/ignite/commit/85bb788bc6ab21668124fe07bee3d984752bc2c5#diff-c309c609b1d06f48b2ba18e3ed3f676150074f3597d72dfd7f3b248aaa082d3aR157
3.
https://github.com/apache/ignite/commit/85bb788bc6ab21668124fe07bee3d984752bc2c5#diff-c309c609b1d06f48b2ba18e3ed3f676150074f3597d72dfd7f3b248aaa082d3aR185
Best regards,
Ilya Shishkov
вт, 5 мая 2026 г. в 16:32, João Lola <jo...@hexa-consulting.pt>:
> Hello,
>
> These vulnerabilities still show up in 2.18. Were they address at all?
>
> Best regards,
> João Lola
> ------------------------------
> *From:* João Lola <jo...@hexa-consulting.pt>
> *Sent:* Tuesday, September 16, 2025 2:19:45 PM
> *To:* user@ignite.apache.org <us...@ignite.apache.org>
> *Subject:* RE: Apache 2.17 Security Vulnerability sonatype-2021-4292
> sonatype-2022-5219
>
> Hello Ilya,
>
> Sorry, but besides what I have already shared here I don´t have anymore
> information from sonatype about this issue *sonatype-2021-4292*.
>
> Just these links:
>
> - https://cwe.mitre.org/data/definitions/401.html
>
>
>
> - https://issues.apache.org/jira/browse/IGNITE-15921
>
>
>
> - https://github.com/apache/ignite/pull/9610
>
>
> Best Regards | Com os melhores cumprimentos,
> João Lola
> ------------------------------
> *De:* Ilya Shishkov <sh...@gmail.com>
> *Enviado:* 15 de setembro de 2025 15:41
> *Para:* user@ignite.apache.org <us...@ignite.apache.org>
> *Assunto:* Re: Apache 2.17 Security Vulnerability sonatype-2021-4292
> sonatype-2022-5219
>
> But I expected more details from sonatype, since the text description does
> not allow us to determine whether sonatype-2021-4292 is still relevant or
> not.
>
>
> Best regards,
> Ilya Shishkov
>
>
> пн, 15 сент. 2025 г. в 16:33, João Lola <jo...@hexa-consulting.pt>:
>
> Of course, available on GitHub.
>
> Best regards | Com os melhores cumprimentos,
> João Lola
> ------------------------------
> *From:* Ilya Shishkov <sh...@gmail.com>
> *Sent:* Monday, September 15, 2025 10:06:34 AM
> *To:* user@ignite.apache.org <us...@ignite.apache.org>
> *Subject:* Re: Apache 2.17 Security Vulnerability sonatype-2021-4292
> sonatype-2022-5219
>
> Hi,
>
> Where did you take these screenshots?
> In the Ignite source code?
>
> Best regards,
> Ilya Shishkov
>
>
> пн, 15 сент. 2025 г. в 11:56, João Lola <jo...@hexa-consulting.pt>:
>
> Hello Ilya,
>
> Certainly, the lines are 146-211 it's the readFrom() method from
> ClientMessage class in regards to *sonatype-2021-4292*.
>
>
> Also, lines 69-114 from read() method inside GridNioServerBuffer class not
> taken into account in the fix.
>
>
> Regarding to *sonatype 2022-5219*, its 297-308 its
> translateSqlWildcardsToRegex() method inside SqlListenerUtils class.
>
>
>
> Best Regards | Com os melhores cumprimentos,
> João Lola
> ------------------------------
> *De:* Ilya Shishkov <sh...@gmail.com>
> *Enviado:* 11 de setembro de 2025 07:19
> *Para:* user@ignite.apache.org <us...@ignite.apache.org>
> *Assunto:* Re: Apache 2.17 Security Vulnerability sonatype-2021-4292
> sonatype-2022-5219
>
> Hi,
> The memory leak described in sonatype-2021-4292 was fixed a long time
> ago, but could you provide more details about the affected versions
> and specific lines of code?
>
>
> пн, 25 авг. 2025 г. в 16:39, João Lola <jo...@hexa-consulting.pt>:
> >
> > Hello,
> >
> > I am currently analyzing my security reports for my Apache ignite 2.17
> application and I got notify of these security vulnerabilities in said
> reports:
> >
> > sonatype-2021-4292 category 9 threat:
> >
> >
> > The ignite-core package is vulnerable to Memory Leak. The readFrom()
> method in the ClientMessage class prematurely allocates a buffer before
> validating the size in the handshake's header and fails to release the
> reserved space when the header is invalid. This causes the system to
> eventually run out of memory. A remote attacker can exploit this
> vulnerability by sending several malformed messages to initiate connections
> provoking a Denial of Service (DoS) condition in the server.
> >
> > Advisory Deviation Notice: The Sonatype security research team
> discovered that the read() method in the GridNioServerBuffer class, also
> has the vulnerable portion of code in it and was not taken into account in
> the fix.
> >
> > sonatype-2022-5219 category 7 threat:
> >
> >
> > The ignite-core package is vulnerable to Regular Expression Denial of
> Service (ReDoS) attacks. The translateSqlWildcardsToRegex method in the
> SqlListenerUtils class uses an unsafe regular expression to parse table
> names and replace wildcard patterns within SQL queries processed with
> Ignite's JDBC driver. An attacker with the ability to influence table names
> passed to function calls via the JDBC driver may exploit this vulnerability
> to exhaust system resources. This will result in a DoS condition.
> >
> > Are you guys aware of these vulnerabilities? Because these sonatype-type
> warnings are usually ignored or dismissed.
> >
> > Do they represent a possible weakness? Or should I discard them, because
> it's a case of false positive scenario?
> >
> > Best Regards | Com os melhores cumprimentos,
> > João Lola
>
>
Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Posted by João Lola <jo...@hexa-consulting.pt>.
Hello,
These vulnerabilities still show up in 2.18. Were they address at all?
Best regards,
João Lola
________________________________
From: João Lola <jo...@hexa-consulting.pt>
Sent: Tuesday, September 16, 2025 2:19:45 PM
To: user@ignite.apache.org <us...@ignite.apache.org>
Subject: RE: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hello Ilya,
Sorry, but besides what I have already shared here I don´t have anymore information from sonatype about this issue sonatype-2021-4292.
Just these links:
*
https://cwe.mitre.org/data/definitions/401.html
*
https://issues.apache.org/jira/browse/IGNITE-15921
*
https://github.com/apache/ignite/pull/9610
Best Regards | Com os melhores cumprimentos,
João Lola
________________________________
De: Ilya Shishkov <sh...@gmail.com>
Enviado: 15 de setembro de 2025 15:41
Para: user@ignite.apache.org <us...@ignite.apache.org>
Assunto: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
But I expected more details from sonatype, since the text description does not allow us to determine whether sonatype-2021-4292 is still relevant or not.
Best regards,
Ilya Shishkov
пн, 15 сент. 2025 г. в 16:33, João Lola <jo...@hexa-consulting.pt>>:
Of course, available on GitHub.
Best regards | Com os melhores cumprimentos,
João Lola
________________________________
From: Ilya Shishkov <sh...@gmail.com>>
Sent: Monday, September 15, 2025 10:06:34 AM
To: user@ignite.apache.org<ma...@ignite.apache.org> <us...@ignite.apache.org>>
Subject: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
Where did you take these screenshots?
In the Ignite source code?
Best regards,
Ilya Shishkov
пн, 15 сент. 2025 г. в 11:56, João Lola <jo...@hexa-consulting.pt>>:
Hello Ilya,
Certainly, the lines are 146-211 it's the readFrom() method from ClientMessage class in regards to sonatype-2021-4292.
[cid:ii_1994dcdfb67cb971f161]
Also, lines 69-114 from read() method inside GridNioServerBuffer class not taken into account in the fix.
[cid:ii_1994dcdfb67cb971f163]
Regarding to sonatype 2022-5219, its 297-308 its translateSqlWildcardsToRegex() method inside SqlListenerUtils class.
[cid:ii_1994dcdfb67cb971f162]
Best Regards | Com os melhores cumprimentos,
João Lola
________________________________
De: Ilya Shishkov <sh...@gmail.com>>
Enviado: 11 de setembro de 2025 07:19
Para: user@ignite.apache.org<ma...@ignite.apache.org> <us...@ignite.apache.org>>
Assunto: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
The memory leak described in sonatype-2021-4292 was fixed a long time
ago, but could you provide more details about the affected versions
and specific lines of code?
пн, 25 авг. 2025 г. в 16:39, João Lola <jo...@hexa-consulting.pt>>:
>
> Hello,
>
> I am currently analyzing my security reports for my Apache ignite 2.17 application and I got notify of these security vulnerabilities in said reports:
>
> sonatype-2021-4292 category 9 threat:
>
>
> The ignite-core package is vulnerable to Memory Leak. The readFrom() method in the ClientMessage class prematurely allocates a buffer before validating the size in the handshake's header and fails to release the reserved space when the header is invalid. This causes the system to eventually run out of memory. A remote attacker can exploit this vulnerability by sending several malformed messages to initiate connections provoking a Denial of Service (DoS) condition in the server.
>
> Advisory Deviation Notice: The Sonatype security research team discovered that the read() method in the GridNioServerBuffer class, also has the vulnerable portion of code in it and was not taken into account in the fix.
>
> sonatype-2022-5219 category 7 threat:
>
>
> The ignite-core package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The translateSqlWildcardsToRegex method in the SqlListenerUtils class uses an unsafe regular expression to parse table names and replace wildcard patterns within SQL queries processed with Ignite's JDBC driver. An attacker with the ability to influence table names passed to function calls via the JDBC driver may exploit this vulnerability to exhaust system resources. This will result in a DoS condition.
>
> Are you guys aware of these vulnerabilities? Because these sonatype-type warnings are usually ignored or dismissed.
>
> Do they represent a possible weakness? Or should I discard them, because it's a case of false positive scenario?
>
> Best Regards | Com os melhores cumprimentos,
> João Lola
RE: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Posted by João Lola <jo...@hexa-consulting.pt>.
Hello Ilya,
Sorry, but besides what I have already shared here I don´t have anymore information from sonatype about this issue sonatype-2021-4292.
Just these links:
*
https://cwe.mitre.org/data/definitions/401.html
*
https://issues.apache.org/jira/browse/IGNITE-15921
*
https://github.com/apache/ignite/pull/9610
Best Regards | Com os melhores cumprimentos,
João Lola
________________________________
De: Ilya Shishkov <sh...@gmail.com>
Enviado: 15 de setembro de 2025 15:41
Para: user@ignite.apache.org <us...@ignite.apache.org>
Assunto: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
But I expected more details from sonatype, since the text description does not allow us to determine whether sonatype-2021-4292 is still relevant or not.
Best regards,
Ilya Shishkov
пн, 15 сент. 2025 г. в 16:33, João Lola <jo...@hexa-consulting.pt>>:
Of course, available on GitHub.
Best regards | Com os melhores cumprimentos,
João Lola
________________________________
From: Ilya Shishkov <sh...@gmail.com>>
Sent: Monday, September 15, 2025 10:06:34 AM
To: user@ignite.apache.org<ma...@ignite.apache.org> <us...@ignite.apache.org>>
Subject: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
Where did you take these screenshots?
In the Ignite source code?
Best regards,
Ilya Shishkov
пн, 15 сент. 2025 г. в 11:56, João Lola <jo...@hexa-consulting.pt>>:
Hello Ilya,
Certainly, the lines are 146-211 it's the readFrom() method from ClientMessage class in regards to sonatype-2021-4292.
[cid:ii_1994dcdfb67cb971f161]
Also, lines 69-114 from read() method inside GridNioServerBuffer class not taken into account in the fix.
[cid:ii_1994dcdfb67cb971f163]
Regarding to sonatype 2022-5219, its 297-308 its translateSqlWildcardsToRegex() method inside SqlListenerUtils class.
[cid:ii_1994dcdfb67cb971f162]
Best Regards | Com os melhores cumprimentos,
João Lola
________________________________
De: Ilya Shishkov <sh...@gmail.com>>
Enviado: 11 de setembro de 2025 07:19
Para: user@ignite.apache.org<ma...@ignite.apache.org> <us...@ignite.apache.org>>
Assunto: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
The memory leak described in sonatype-2021-4292 was fixed a long time
ago, but could you provide more details about the affected versions
and specific lines of code?
пн, 25 авг. 2025 г. в 16:39, João Lola <jo...@hexa-consulting.pt>>:
>
> Hello,
>
> I am currently analyzing my security reports for my Apache ignite 2.17 application and I got notify of these security vulnerabilities in said reports:
>
> sonatype-2021-4292 category 9 threat:
>
>
> The ignite-core package is vulnerable to Memory Leak. The readFrom() method in the ClientMessage class prematurely allocates a buffer before validating the size in the handshake's header and fails to release the reserved space when the header is invalid. This causes the system to eventually run out of memory. A remote attacker can exploit this vulnerability by sending several malformed messages to initiate connections provoking a Denial of Service (DoS) condition in the server.
>
> Advisory Deviation Notice: The Sonatype security research team discovered that the read() method in the GridNioServerBuffer class, also has the vulnerable portion of code in it and was not taken into account in the fix.
>
> sonatype-2022-5219 category 7 threat:
>
>
> The ignite-core package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The translateSqlWildcardsToRegex method in the SqlListenerUtils class uses an unsafe regular expression to parse table names and replace wildcard patterns within SQL queries processed with Ignite's JDBC driver. An attacker with the ability to influence table names passed to function calls via the JDBC driver may exploit this vulnerability to exhaust system resources. This will result in a DoS condition.
>
> Are you guys aware of these vulnerabilities? Because these sonatype-type warnings are usually ignored or dismissed.
>
> Do they represent a possible weakness? Or should I discard them, because it's a case of false positive scenario?
>
> Best Regards | Com os melhores cumprimentos,
> João Lola
Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Posted by Ilya Shishkov <sh...@gmail.com>.
But I expected more details from sonatype, since the text description does
not allow us to determine whether sonatype-2021-4292 is still relevant or
not.
Best regards,
Ilya Shishkov
пн, 15 сент. 2025 г. в 16:33, João Lola <jo...@hexa-consulting.pt>:
> Of course, available on GitHub.
>
> Best regards | Com os melhores cumprimentos,
> João Lola
> ------------------------------
> *From:* Ilya Shishkov <sh...@gmail.com>
> *Sent:* Monday, September 15, 2025 10:06:34 AM
> *To:* user@ignite.apache.org <us...@ignite.apache.org>
> *Subject:* Re: Apache 2.17 Security Vulnerability sonatype-2021-4292
> sonatype-2022-5219
>
> Hi,
>
> Where did you take these screenshots?
> In the Ignite source code?
>
> Best regards,
> Ilya Shishkov
>
>
> пн, 15 сент. 2025 г. в 11:56, João Lola <jo...@hexa-consulting.pt>:
>
> Hello Ilya,
>
> Certainly, the lines are 146-211 it's the readFrom() method from
> ClientMessage class in regards to *sonatype-2021-4292*.
>
>
> Also, lines 69-114 from read() method inside GridNioServerBuffer class not
> taken into account in the fix.
>
>
> Regarding to *sonatype 2022-5219*, its 297-308 its
> translateSqlWildcardsToRegex() method inside SqlListenerUtils class.
>
>
>
> Best Regards | Com os melhores cumprimentos,
> João Lola
> ------------------------------
> *De:* Ilya Shishkov <sh...@gmail.com>
> *Enviado:* 11 de setembro de 2025 07:19
> *Para:* user@ignite.apache.org <us...@ignite.apache.org>
> *Assunto:* Re: Apache 2.17 Security Vulnerability sonatype-2021-4292
> sonatype-2022-5219
>
> Hi,
> The memory leak described in sonatype-2021-4292 was fixed a long time
> ago, but could you provide more details about the affected versions
> and specific lines of code?
>
>
> пн, 25 авг. 2025 г. в 16:39, João Lola <jo...@hexa-consulting.pt>:
> >
> > Hello,
> >
> > I am currently analyzing my security reports for my Apache ignite 2.17
> application and I got notify of these security vulnerabilities in said
> reports:
> >
> > sonatype-2021-4292 category 9 threat:
> >
> >
> > The ignite-core package is vulnerable to Memory Leak. The readFrom()
> method in the ClientMessage class prematurely allocates a buffer before
> validating the size in the handshake's header and fails to release the
> reserved space when the header is invalid. This causes the system to
> eventually run out of memory. A remote attacker can exploit this
> vulnerability by sending several malformed messages to initiate connections
> provoking a Denial of Service (DoS) condition in the server.
> >
> > Advisory Deviation Notice: The Sonatype security research team
> discovered that the read() method in the GridNioServerBuffer class, also
> has the vulnerable portion of code in it and was not taken into account in
> the fix.
> >
> > sonatype-2022-5219 category 7 threat:
> >
> >
> > The ignite-core package is vulnerable to Regular Expression Denial of
> Service (ReDoS) attacks. The translateSqlWildcardsToRegex method in the
> SqlListenerUtils class uses an unsafe regular expression to parse table
> names and replace wildcard patterns within SQL queries processed with
> Ignite's JDBC driver. An attacker with the ability to influence table names
> passed to function calls via the JDBC driver may exploit this vulnerability
> to exhaust system resources. This will result in a DoS condition.
> >
> > Are you guys aware of these vulnerabilities? Because these sonatype-type
> warnings are usually ignored or dismissed.
> >
> > Do they represent a possible weakness? Or should I discard them, because
> it's a case of false positive scenario?
> >
> > Best Regards | Com os melhores cumprimentos,
> > João Lola
>
>
Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Posted by João Lola <jo...@hexa-consulting.pt>.
Of course, available on GitHub.
Best regards | Com os melhores cumprimentos,
João Lola
________________________________
From: Ilya Shishkov <sh...@gmail.com>
Sent: Monday, September 15, 2025 10:06:34 AM
To: user@ignite.apache.org <us...@ignite.apache.org>
Subject: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
Where did you take these screenshots?
In the Ignite source code?
Best regards,
Ilya Shishkov
пн, 15 сент. 2025 г. в 11:56, João Lola <jo...@hexa-consulting.pt>>:
Hello Ilya,
Certainly, the lines are 146-211 it's the readFrom() method from ClientMessage class in regards to sonatype-2021-4292.
[cid:ii_1994c9e40bacb971f161]
Also, lines 69-114 from read() method inside GridNioServerBuffer class not taken into account in the fix.
[cid:ii_1994c9e40bacb971f163]
Regarding to sonatype 2022-5219, its 297-308 its translateSqlWildcardsToRegex() method inside SqlListenerUtils class.
[cid:ii_1994c9e40bacb971f162]
Best Regards | Com os melhores cumprimentos,
João Lola
________________________________
De: Ilya Shishkov <sh...@gmail.com>>
Enviado: 11 de setembro de 2025 07:19
Para: user@ignite.apache.org<ma...@ignite.apache.org> <us...@ignite.apache.org>>
Assunto: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
The memory leak described in sonatype-2021-4292 was fixed a long time
ago, but could you provide more details about the affected versions
and specific lines of code?
пн, 25 авг. 2025 г. в 16:39, João Lola <jo...@hexa-consulting.pt>>:
>
> Hello,
>
> I am currently analyzing my security reports for my Apache ignite 2.17 application and I got notify of these security vulnerabilities in said reports:
>
> sonatype-2021-4292 category 9 threat:
>
>
> The ignite-core package is vulnerable to Memory Leak. The readFrom() method in the ClientMessage class prematurely allocates a buffer before validating the size in the handshake's header and fails to release the reserved space when the header is invalid. This causes the system to eventually run out of memory. A remote attacker can exploit this vulnerability by sending several malformed messages to initiate connections provoking a Denial of Service (DoS) condition in the server.
>
> Advisory Deviation Notice: The Sonatype security research team discovered that the read() method in the GridNioServerBuffer class, also has the vulnerable portion of code in it and was not taken into account in the fix.
>
> sonatype-2022-5219 category 7 threat:
>
>
> The ignite-core package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The translateSqlWildcardsToRegex method in the SqlListenerUtils class uses an unsafe regular expression to parse table names and replace wildcard patterns within SQL queries processed with Ignite's JDBC driver. An attacker with the ability to influence table names passed to function calls via the JDBC driver may exploit this vulnerability to exhaust system resources. This will result in a DoS condition.
>
> Are you guys aware of these vulnerabilities? Because these sonatype-type warnings are usually ignored or dismissed.
>
> Do they represent a possible weakness? Or should I discard them, because it's a case of false positive scenario?
>
> Best Regards | Com os melhores cumprimentos,
> João Lola
Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Posted by Ilya Shishkov <sh...@gmail.com>.
Hi,
Where did you take these screenshots?
In the Ignite source code?
Best regards,
Ilya Shishkov
пн, 15 сент. 2025 г. в 11:56, João Lola <jo...@hexa-consulting.pt>:
> Hello Ilya,
>
> Certainly, the lines are 146-211 it's the readFrom() method from
> ClientMessage class in regards to *sonatype-2021-4292*.
>
>
> Also, lines 69-114 from read() method inside GridNioServerBuffer class not
> taken into account in the fix.
>
>
> Regarding to *sonatype 2022-5219*, its 297-308 its
> translateSqlWildcardsToRegex() method inside SqlListenerUtils class.
>
>
>
> Best Regards | Com os melhores cumprimentos,
> João Lola
> ------------------------------
> *De:* Ilya Shishkov <sh...@gmail.com>
> *Enviado:* 11 de setembro de 2025 07:19
> *Para:* user@ignite.apache.org <us...@ignite.apache.org>
> *Assunto:* Re: Apache 2.17 Security Vulnerability sonatype-2021-4292
> sonatype-2022-5219
>
> Hi,
> The memory leak described in sonatype-2021-4292 was fixed a long time
> ago, but could you provide more details about the affected versions
> and specific lines of code?
>
>
> пн, 25 авг. 2025 г. в 16:39, João Lola <jo...@hexa-consulting.pt>:
> >
> > Hello,
> >
> > I am currently analyzing my security reports for my Apache ignite 2.17
> application and I got notify of these security vulnerabilities in said
> reports:
> >
> > sonatype-2021-4292 category 9 threat:
> >
> >
> > The ignite-core package is vulnerable to Memory Leak. The readFrom()
> method in the ClientMessage class prematurely allocates a buffer before
> validating the size in the handshake's header and fails to release the
> reserved space when the header is invalid. This causes the system to
> eventually run out of memory. A remote attacker can exploit this
> vulnerability by sending several malformed messages to initiate connections
> provoking a Denial of Service (DoS) condition in the server.
> >
> > Advisory Deviation Notice: The Sonatype security research team
> discovered that the read() method in the GridNioServerBuffer class, also
> has the vulnerable portion of code in it and was not taken into account in
> the fix.
> >
> > sonatype-2022-5219 category 7 threat:
> >
> >
> > The ignite-core package is vulnerable to Regular Expression Denial of
> Service (ReDoS) attacks. The translateSqlWildcardsToRegex method in the
> SqlListenerUtils class uses an unsafe regular expression to parse table
> names and replace wildcard patterns within SQL queries processed with
> Ignite's JDBC driver. An attacker with the ability to influence table names
> passed to function calls via the JDBC driver may exploit this vulnerability
> to exhaust system resources. This will result in a DoS condition.
> >
> > Are you guys aware of these vulnerabilities? Because these sonatype-type
> warnings are usually ignored or dismissed.
> >
> > Do they represent a possible weakness? Or should I discard them, because
> it's a case of false positive scenario?
> >
> > Best Regards | Com os melhores cumprimentos,
> > João Lola
>
RE: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Posted by João Lola <jo...@hexa-consulting.pt>.
Hello Ilya,
Certainly, the lines are 146-211 it's the readFrom() method from ClientMessage class in regards to sonatype-2021-4292.
[cid:f8a8556d-d5c5-4f3d-bd31-9ecfb7b01185]
Also, lines 69-114 from read() method inside GridNioServerBuffer class not taken into account in the fix.
[cid:a51339e2-2fae-4627-abd8-74543a82d924]
Regarding to sonatype 2022-5219, its 297-308 its translateSqlWildcardsToRegex() method inside SqlListenerUtils class.
[cid:67fbdafb-1d8c-4147-8772-03732a5672c8]
Best Regards | Com os melhores cumprimentos,
João Lola
________________________________
De: Ilya Shishkov <sh...@gmail.com>
Enviado: 11 de setembro de 2025 07:19
Para: user@ignite.apache.org <us...@ignite.apache.org>
Assunto: Re: Apache 2.17 Security Vulnerability sonatype-2021-4292 sonatype-2022-5219
Hi,
The memory leak described in sonatype-2021-4292 was fixed a long time
ago, but could you provide more details about the affected versions
and specific lines of code?
пн, 25 авг. 2025 г. в 16:39, João Lola <jo...@hexa-consulting.pt>:
>
> Hello,
>
> I am currently analyzing my security reports for my Apache ignite 2.17 application and I got notify of these security vulnerabilities in said reports:
>
> sonatype-2021-4292 category 9 threat:
>
>
> The ignite-core package is vulnerable to Memory Leak. The readFrom() method in the ClientMessage class prematurely allocates a buffer before validating the size in the handshake's header and fails to release the reserved space when the header is invalid. This causes the system to eventually run out of memory. A remote attacker can exploit this vulnerability by sending several malformed messages to initiate connections provoking a Denial of Service (DoS) condition in the server.
>
> Advisory Deviation Notice: The Sonatype security research team discovered that the read() method in the GridNioServerBuffer class, also has the vulnerable portion of code in it and was not taken into account in the fix.
>
> sonatype-2022-5219 category 7 threat:
>
>
> The ignite-core package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. The translateSqlWildcardsToRegex method in the SqlListenerUtils class uses an unsafe regular expression to parse table names and replace wildcard patterns within SQL queries processed with Ignite's JDBC driver. An attacker with the ability to influence table names passed to function calls via the JDBC driver may exploit this vulnerability to exhaust system resources. This will result in a DoS condition.
>
> Are you guys aware of these vulnerabilities? Because these sonatype-type warnings are usually ignored or dismissed.
>
> Do they represent a possible weakness? Or should I discard them, because it's a case of false positive scenario?
>
> Best Regards | Com os melhores cumprimentos,
> João Lola