Description
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ckeditor | ckeditor4 | < 4.18.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | ckeditor | 4.19.0+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | request-tracker4 +1 | No fix yet | — |
| Ubuntu 25.10 | request-tracker4 +1 | No fix yet | — |
| Ubuntu 24.04 LTS | ckeditor3 +2 | No fix yet | — |
| Ubuntu 22.04 LTS | ckeditor3 +2 | No fix yet | — |
| Ubuntu 20.04 LTS | ckeditor3 +2 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ckeditor3 +1 | No fix yet | — |
| Ubuntu 16.04 LTS | request-tracker4 +1 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | request-tracker4 | No fix yet | — |
Advisories 1
- WID-SEC-2023-1023 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
References
- https://ckeditor.com/cke4/release/CKEditor-4.18.0
- https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.drupal.org/sa-core-2022-005
- FEDORA-2022-b61dfd219b vendor-advisory
- FEDORA-2022-4c634ee466 vendor-advisory