GHSA-jxqq-cqm6-pfq9

Source

https://github.com/advisories/GHSA-jxqq-cqm6-pfq9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-jxqq-cqm6-pfq9/GHSA-jxqq-cqm6-pfq9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jxqq-cqm6-pfq9

Aliases

CVE-2017-16117

Published

2018-07-24T20:06:45Z

Modified

2023-11-08T03:59:05Z

Summary

Regular Expression Denial of Service in slug

Details

Affected versions of slug are vulnerable to a regular expression denial of service when parsing untrusted user input.

The issue is low severity, as it takes 50,000 characters to cause the event loop to block for 2 seconds,

About 50k characters can block the event loop for 2 seconds.

Recommendation

Update to version 0.9.2 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:44:29Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / slug

Package

Name: slug; View open source insights on deps.dev
Purl: pkg:npm/slug

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.9.2

Database specific

last_known_affected_version_range

"<= 0.9.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-jxqq-cqm6-pfq9/GHSA-jxqq-cqm6-pfq9.json"