GHSA-42j4-733x-5vcf

Source

https://github.com/advisories/GHSA-42j4-733x-5vcf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-42j4-733x-5vcf/GHSA-42j4-733x-5vcf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-42j4-733x-5vcf

Aliases

CVE-2020-36320

Published

2021-04-19T14:49:32Z

Modified

2024-05-15T06:30:47Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7

Details

Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

https://vaadin.com/security/cve-2020-36320

Database specific

{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-16T23:15:27Z",
    "nvd_published_at": "2021-04-23T16:15:00Z",
    "severity": "HIGH"
}

References

Affected packages

Maven / com.vaadin:vaadin-bom

Package

Name: com.vaadin:vaadin-bom; View open source insights on deps.dev
Purl: pkg:maven/com.vaadin/vaadin-bom

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0.beta1

Fixed

7.7.22

Affected versions

7.*

7.4.0

7.4.1

7.4.2

7.4.3

7.4.4

7.4.5

7.4.6

7.4.7

7.4.8

7.5.0.beta1

7.5.0.beta2

7.5.0.beta3

7.5.0.rc1

7.5.0.rc2

7.5.0

7.5.1

7.5.2

7.5.3

7.5.4

7.5.5

7.5.6

7.5.7

7.5.8

7.5.9

7.5.10

7.6.0.alpha1

7.6.0.alpha2

7.6.0

7.6.1

7.6.2

7.6.3

7.6.4

7.6.5

7.6.6

7.6.7

7.6.8

7.7.0

7.7.1

7.7.2

7.7.3

7.7.4

7.7.5

7.7.6

7.7.7

7.7.8

7.7.9

7.7.10

7.7.11

7.7.12

7.7.13

7.7.14

7.7.15

7.7.16

7.7.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-42j4-733x-5vcf/GHSA-42j4-733x-5vcf.json"

Maven / com.vaadin:vaadin-server

Package

Name: com.vaadin:vaadin-server; View open source insights on deps.dev
Purl: pkg:maven/com.vaadin/vaadin-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0.beta1

Fixed

7.7.22

Affected versions

7.*

7.0.0.beta1

7.0.0.beta2

7.0.0.beta3

7.0.0.beta4

7.0.0.beta5

7.0.0.beta6

7.0.0.beta7

7.0.0.beta8

7.0.0.beta9

7.0.0.beta10

7.0.0.beta11

7.0.0.rc1

7.0.0.rc2

7.0.0

7.0.1

7.0.2

7.0.3

7.0.4

7.0.5

7.0.6

7.0.7

7.1.0.beta1

7.1.0

7.1.1

7.1.2

7.1.3

7.1.4

7.1.5

7.1.6

7.1.7

7.1.8

7.1.9

7.1.10

7.1.11

7.1.12

7.1.13

7.1.14

7.1.15

7.2.0.beta1

7.2.0

7.2.1

7.2.2

7.2.3

7.2.4

7.2.5

7.2.6

7.2.7

7.3.0.alpha1

7.3.0.alpha2

7.3.0.alpha3

7.3.0.beta1

7.3.0.rc1

7.3.0

7.3.1

7.3.2

7.3.3

7.3.4

7.3.5

7.3.6

7.3.7

7.3.8

7.3.9

7.3.10

7.4.0.alpha1

7.4.0.alpha2

7.4.0.alpha3

7.4.0.alpha4

7.4.0.alpha5

7.4.0.alpha6

7.4.0.alpha7

7.4.0.alpha8

7.4.0.alpha9

7.4.0.alpha10

7.4.0.alpha11

7.4.0.alpha12

7.4.0.alpha13

7.4.0.alpha14

7.4.0.beta1

7.4.0.beta2

7.4.0.beta3

7.4.0.rc1