GHSA-jfmf-w293-8xr8

Source

https://github.com/advisories/GHSA-jfmf-w293-8xr8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-jfmf-w293-8xr8/GHSA-jfmf-w293-8xr8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jfmf-w293-8xr8

Published

2021-10-13T18:55:52Z

Modified

2024-12-02T05:49:30.705064Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8

Details

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

Database specific

{
    "severity": "HIGH",
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-13T17:43:34Z",
    "nvd_published_at": null
}

References

Affected packages

Maven / com.vaadin:vaadin-bom

Package

Name: com.vaadin:vaadin-bom; View open source insights on deps.dev
Purl: pkg:maven/com.vaadin/vaadin-bom

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.0.0

Fixed

8.13.0

Affected versions

8.*

8.0.0

8.0.1

8.0.2

8.0.3

8.0.4

8.0.5

8.0.6

8.0.7

8.1.0

8.1.1

8.1.2

8.1.3

8.1.4

8.1.5

8.1.6

8.1.7

8.1.8

8.2.0

8.2.1

8.3.0

8.3.1

8.3.2

8.3.3

8.4.0

8.4.1

8.4.2

8.4.3

8.4.4

8.4.5

8.5.0

8.5.1

8.5.2

8.6.0

8.6.1

8.6.2

8.6.3

8.6.4

8.7.0.beta1

8.7.0

8.7.1

8.7.2

8.8.0

8.8.1

8.8.2

8.8.3

8.8.4

8.8.5

8.8.6

8.9.0

8.9.1

8.9.2

8.9.3

8.9.4

8.10.0

8.10.1

8.10.2

8.10.3

8.10.4

8.10.5

8.11.0

8.11.1

8.11.2

8.11.3

8.12.0

8.12.1

8.12.2

8.12.3

8.12.4

Database specific

last_known_affected_version_range

"<= 8.12.4"