semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-25883US | high7.5 | — | ||
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a ran… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/npm/node-semverPACKAGE
- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104WEB
- https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js#L138WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js#L160WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L138WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L160WEB
- https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan