CVE-2021-27290
mediumpriority · track · 32EPSS 0.047 · 92 %ileDEEURUUSEPSS · scored 2026-10-26
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedfesto_psirt
FactoryViews (non-Lite): Upgrade to FactoryViews 1.6.0. See the upgrade guide for information on how to upgrade. FactoryViews Lite: Upgrade to FactoryViews 1.7.0. See the upgrade guide for information on how to upgrade.
- FixedSINEC INSsiemens_psirt
Update to V1.0.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806100/ - FixedSINEC INScisa_csaf_ot
Update to V1.0.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806100/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (47)
Products and version ranges known to be affected.
- IBM Spectrum Scale 1.1.8.0 - 1.1.8.4all versionscert_bundDEcpe:/a:ibm:spectrum_scale:1.1.8.0_-_1.1.8.4
- Oracle Java SE Oracle GraalVM Enterprise Edition: 20.3.3all versionscert_bundDEcpe:/a:oracle:java_se:oracle_graalvm_enterprise_edition_20.3.3
advisories (8)
Vendor and ecosystem advisories describing this.
- FSA-202302Festo: Several vulnerabilities in FactoryViews2023-07-10csaf · festo_psirtDE
FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications. FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities. At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.
- SSA-389290SSA-389290: Third-Party Component Vulnerabilities in SINEC INS2022-03-08csaf · siemens_psirtDE
71 vulnerabilities in third-party components as Node.js, cURL, SQLite, CivetWeb and DNS(ISC BIND) could allow an attacker to interfere with the affected product in various ways. Siemens has released an update for SINEC INS and recommends to update to the latest versions.
- WID-SEC-W-2022-0196Oracle Java SE: Mehrere SchwachstellenDeutsch2021-10-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-0856IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2022-05-31csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0042Node.js: Mehrere SchwachstellenDeutsch2021-07-01csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Informationen offenzulegen, seine Privilegien zu erweitern oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2024-1591Juniper JUNOS: Mehrere SchwachstellenDeutsch2024-07-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.
- GHSA-vx3p-948g-6vhqRegular Expression Denial of Service (ReDoS)2021-03-19ghsa · osvUS
npm `ssri` 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
- ICSA-22-069-09Siemens SINEC INS2022-03-08icsa · cisa_csaf_otUS
71 vulnerabilities in third-party components as Node.js, cURL, SQLite, CivetWeb and DNS(ISC BIND) could allow an attacker to interfere with the affected product in various ways. Siemens has released an update for SINEC INS and recommends to update to the latest versions.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (35)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfcnnvd
- https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdfcnnvd
- https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdfcnnvd
- https://npmjs.comcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-27290cnnvd
- https://packetstormsecurity.com/files/163694/Red-Hat-Security-Advisory-2021-2932-01.htmlcnnvd
- https://packetstormsecurity.com/files/163778/Red-Hat-Security-Advisory-2021-3074-01.htmlcnnvd
- https://packetstormsecurity.com/files/164257/Red-Hat-Security-Advisory-2021-3638-01.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan