CVE-2021-27290: npm upgrade - ssri Regular Expression Denial of Service (ReDoS)
A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service (ReDoS). This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability.
Other sources
Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Reference:
https://doyensec.com/resources/DoyensecAdvisoryssriredos.pdf
— Red Hat
Node.js ssri module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw by the SRIs. By sending a specially-crafted regex string, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
npm ssri 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
This is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks.
You can read more about it in https://github.com/advisories/GHSA-vx3p-948g-6vhq
All versions of the 12.x release line
Versions of the 14.x release line before 14.17.0 which included an update to the latest npm 6.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ssrito a version that resolves this vulnerability.Fixed in 8.0.1 - Upgrade
Upgrade
npm/ssrito a version that resolves this vulnerability.Fixed in 7.1.1 - Upgrade
Upgrade
npm/ssrito a version that resolves this vulnerability.Fixed in 6.0.2 - Upgrade
Upgrade
redhat/rh-nodejs12-nodejsto a version that resolves this vulnerability.Fixed in 0:12.22.2-1.el7 - Upgrade
Upgrade
redhat/rh-nodejs12-nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:2.0.3-2.el7 - Upgrade
Upgrade
redhat/rh-nodejs14-nodejsto a version that resolves this vulnerability.Fixed in 0:14.17.2-1.el7 - Upgrade
Upgrade
redhat/rh-nodejs14-nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:2.0.3-2.el7 - Upgrade
Upgrade
redhat/ssrito a version that resolves this vulnerability.Fixed in 8.0.1 - Upgrade
Upgrade
redhat/ssrito a version that resolves this vulnerability.Fixed in 7.1.1 - Upgrade
Upgrade
redhat/ssrito a version that resolves this vulnerability.Fixed in 6.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-27290?
CVE-2021-27290 is a vulnerability in the ssri package that allows a denial of service attack by processing malicious strings that take a long time to process.
What software is affected by CVE-2021-27290?
The ssri package versions 5.2.2-6.0.1 and 7.0.0-8.0.0 are affected by CVE-2021-27290.
What is the severity of CVE-2021-27290?
The severity of CVE-2021-27290 is high, with a severity score of 7.5.
How can I fix CVE-2021-27290?
To fix CVE-2021-27290, upgrade to ssri version 8.0.1 if using npm or the corresponding version provided by Red Hat if using their package.
Where can I find more information about CVE-2021-27290?
You can find more information about CVE-2021-27290 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-27290), [GitHub](https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2), [Doyensec Advisory](https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf).