GHSA-fx7m-j728-mjw3

Suggest an improvement
Source
https://github.com/advisories/GHSA-fx7m-j728-mjw3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-fx7m-j728-mjw3/GHSA-fx7m-j728-mjw3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fx7m-j728-mjw3
Aliases
Published
2019-03-06T17:35:47Z
Modified
2023-11-08T04:00:11Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
uap-core Regular Expression Denial of Service issue
Details

An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)

Database specific 
{
    "cwe_ids":  [
        "CWE-185"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:35:45Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / uap-core

Package

Name
uap-core
View open source insights on deps.dev
Purl
pkg:npm/uap-core

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-fx7m-j728-mjw3/GHSA-fx7m-j728-mjw3.json"