CVE-2021-23362: Regular Expression Denial of Service (ReDoS)
A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression (regexp) function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process, potentially resulting in a denial of service.
Other sources
Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the fromUrl function in index.js. By sending a specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via shortcutMatch in fromUrl().
References:
https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356 https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
Fixed releases : hosted-git-info 3.0.8, hosted-git-info 2.8.9
— Red Hat
This is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks.
You can read more about it in https://nvd.nist.gov/vuln/detail/CVE-2021-23362
All versions of the 12.x release line
Versions of the 14.x release line before 14.17.0 which included an update to the latest npm 6.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-nodejs12-nodejsto a version that resolves this vulnerability.Fixed in 0:12.22.2-1.el7 - Upgrade
Upgrade
redhat/rh-nodejs12-nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:2.0.3-2.el7 - Upgrade
Upgrade
redhat/rh-nodejs14-nodejsto a version that resolves this vulnerability.Fixed in 0:14.17.2-1.el7 - Upgrade
Upgrade
redhat/rh-nodejs14-nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:2.0.3-2.el7 - Upgrade
Upgrade
redhat/hosted-git-infoto a version that resolves this vulnerability.Fixed in 3.0.8 - Upgrade
Upgrade
redhat/hosted-git-infoto a version that resolves this vulnerability.Fixed in 2.8.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.2 - Upgrade
Upgrade
npm/hosted-git-infoto a version that resolves this vulnerability.Fixed in 3.0.8 - Upgrade
Upgrade
npm/hosted-git-infoto a version that resolves this vulnerability.Fixed in 2.8.9
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-23362.
What is the severity of CVE-2021-23362?
The severity of CVE-2021-23362 is high with a score of 7.5.
Which software versions are affected by CVE-2021-23362?
The affected software versions are hosted-git-info before 3.0.8 and 2.0.0 to 2.8.9.
How can an attacker exploit CVE-2021-23362?
An attacker can exploit CVE-2021-23362 by crafting a regular expression that takes an ever increasing amount of time to process, leading to a denial of service.
Where can I find more information about CVE-2021-23362?
You can find more information about CVE-2021-23362 at the following references: [link1](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf), [link2](https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7), [link3](https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01).