Regular Expression Denial of Service (ReDoS)
npm `ssri` 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-27290US | high7.5 | — | ||
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process,… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfWEB
- https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdfWEB
- https://github.com/npm/ssriPACKAGE
- https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2WEB
- https://github.com/npm/ssri/commit/809c84d09ea87c3857fa171d42914586899d4538WEB
- https://github.com/npm/ssri/commit/b30dfdb00bb94ddc49a25a85a18fb27afafdfbb1WEB
- https://github.com/npm/ssri/pull/20#issuecomment-842677644WEB
- https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdfWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan