CVE-2021-23362: Regular Expression Denial of Service (ReDoS)
First published: Tue Mar 23 2021(Updated: )
Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the fromUrl function in index.js. By sending a specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Credit: report@snyk.io report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Npmjs Hosted-git-info | >=2.0.0<2.8.9 | |
| Npmjs Hosted-git-info | >=3.0.0<3.0.8 | |
| Siemens Sinec Infrastructure Network Services | <1.0.1.1 | |
| redhat/rh-nodejs12-nodejs | <0:12.22.2-1.el7 | 0:12.22.2-1.el7 |
| redhat/rh-nodejs12-nodejs-nodemon | <0:2.0.3-2.el7 | 0:2.0.3-2.el7 |
| redhat/rh-nodejs14-nodejs | <0:14.17.2-1.el7 | 0:14.17.2-1.el7 |
| redhat/rh-nodejs14-nodejs-nodemon | <0:2.0.3-2.el7 | 0:2.0.3-2.el7 |
| redhat/hosted-git-info | <3.0.8 | 3.0.8 |
| redhat/hosted-git-info | <2.8.9 | 2.8.9 |
| IBM Cloud Pak for Security (CP4S) | <=1.7.2.0 | |
| IBM Cloud Pak for Security (CP4S) | <=1.7.1.0 | |
| IBM Cloud Pak for Security (CP4S) | <=1.7.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
- https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01
- https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
- https://github.com/npm/hosted-git-info/commits/v2
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
- https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
- https://www.cve.org/CVERecord?id=CVE-2021-23362 https://nvd.nist.gov/vuln/detail/CVE-2021-23362
- https://bugzilla.redhat.com/show_bug.cgi?id=1943208
- https://access.redhat.com/errata/RHSA-2021:3016
- https://access.redhat.com/errata/RHSA-2021:3073
- https://access.redhat.com/errata/RHSA-2021:3074
- https://access.redhat.com/errata/RHSA-2021:3639
- https://access.redhat.com/errata/RHSA-2021:3638
- https://access.redhat.com/errata/RHSA-2021:2438
- https://access.redhat.com/errata/RHSA-2021:2931
- https://access.redhat.com/errata/RHSA-2021:2932
- https://access.redhat.com/security/cve/cve-2021-23362
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1943210
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1943209
- https://access.redhat.com/solutions/5707561
- https://github.com/RedHatInsights/drift-frontend/pull/472
- https://exchange.xforce.ibmcloud.com/vulnerabilities/198792
- https://www.ibm.com/support/pages/node/6493729 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-23362.
What is the severity of CVE-2021-23362?
The severity of CVE-2021-23362 is high with a score of 7.5.
Which software versions are affected by CVE-2021-23362?
The affected software versions are hosted-git-info before 3.0.8 and 2.0.0 to 2.8.9.
How can an attacker exploit CVE-2021-23362?
An attacker can exploit CVE-2021-23362 by crafting a regular expression that takes an ever increasing amount of time to process, leading to a denial of service.
Where can I find more information about CVE-2021-23362?
You can find more information about CVE-2021-23362 at the following references: [link1](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf), [link2](https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7), [link3](https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01).
- collector/nvd-api
- collector/redhat-cve
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-23362
- agent/software-canonical-lookup
- agent/references
- agent/softwarecombine
- collector/ibm-support
- source/IBM
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/event
- vendor/npmjs
- canonical/npmjs hosted-git-info
- version/npmjs hosted-git-info/2.0.0
- version/npmjs hosted-git-info/3.0.0
- vendor/siemens
- canonical/siemens sinec infrastructure network services
- package-manager/redhat
- vendor/ibm
- canonical/ibm cloud pak for security (cp4s)
- version/ibm cloud pak for security (cp4s)/1.7.2.0
- version/ibm cloud pak for security (cp4s)/1.7.1.0
- version/ibm cloud pak for security (cp4s)/1.7.0.0