CVE-2021-27290
First published: Fri Mar 12 2021(Updated: )
A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service (ReDoS). This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/ssri | =8.0.0 | 8.0.1 |
| npm/ssri | >=7.0.0<7.1.1 | 7.1.1 |
| npm/ssri | >=5.2.2<6.0.2 | 6.0.2 |
| redhat/rh-nodejs12-nodejs | <0:12.22.2-1.el7 | 0:12.22.2-1.el7 |
| redhat/rh-nodejs12-nodejs-nodemon | <0:2.0.3-2.el7 | 0:2.0.3-2.el7 |
| redhat/rh-nodejs14-nodejs | <0:14.17.2-1.el7 | 0:14.17.2-1.el7 |
| redhat/rh-nodejs14-nodejs-nodemon | <0:2.0.3-2.el7 | 0:2.0.3-2.el7 |
| Ssri Project Ssri | >=5.2.2<6.0.2 | |
| Ssri Project Ssri | >=7.0.0<8.0.1 | |
| Oracle GraalVM | =20.3.3 | |
| Oracle GraalVM | =21.2.0 | |
| Siemens Sinec Infrastructure Network Services | <1.0.1.1 | |
| redhat/ssri | <8.0.1 | 8.0.1 |
| redhat/ssri | <7.1.1 | 7.1.1 |
| redhat/ssri | <6.0.2 | 6.0.2 |
| IBM Cloud Pak for Security (CP4S) | <=1.7.2.0 | |
| IBM Cloud Pak for Security (CP4S) | <=1.7.1.0 | |
| IBM Cloud Pak for Security (CP4S) | <=1.7.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2021-27290
- https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2
- https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf
- https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdf
- https://github.com/npm/ssri/commit/b30dfdb00bb94ddc49a25a85a18fb27afafdfbb1
- https://www.npmjs.com/package/ssri
- https://github.com/npm/ssri/pull/20#issuecomment-842677644
- https://npmjs.com
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/npm/ssri/commit/809c84d09ea87c3857fa171d42914586899d4538
- https://github.com/advisories/GHSA-vx3p-948g-6vhq (Advisory)
- https://www.cve.org/CVERecord?id=CVE-2021-27290 https://nvd.nist.gov/vuln/detail/CVE-2021-27290
- https://bugzilla.redhat.com/show_bug.cgi?id=1941471
- https://access.redhat.com/errata/RHSA-2021:3073
- https://access.redhat.com/errata/RHSA-2021:3074
- https://access.redhat.com/errata/RHSA-2021:3639
- https://access.redhat.com/errata/RHSA-2021:3638
- https://access.redhat.com/errata/RHSA-2021:2931
- https://access.redhat.com/errata/RHSA-2021:2932
- https://access.redhat.com/security/cve/cve-2021-27290
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1941472
- https://github.com/npm/ssri/commit/76e223317d971
- https://github.com/npm/ssri/commit/d0ebcdc
- https://exchange.xforce.ibmcloud.com/vulnerabilities/198144
- https://www.ibm.com/support/pages/node/6493729
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2021-27290?
CVE-2021-27290 is a vulnerability in the ssri package that allows a denial of service attack by processing malicious strings that take a long time to process.
What software is affected by CVE-2021-27290?
The ssri package versions 5.2.2-6.0.1 and 7.0.0-8.0.0 are affected by CVE-2021-27290.
What is the severity of CVE-2021-27290?
The severity of CVE-2021-27290 is high, with a severity score of 7.5.
How can I fix CVE-2021-27290?
To fix CVE-2021-27290, upgrade to ssri version 8.0.1 if using npm or the corresponding version provided by Red Hat if using their package.
Where can I find more information about CVE-2021-27290?
You can find more information about CVE-2021-27290 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-27290), [GitHub](https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2), [Doyensec Advisory](https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf).
- collector/github-advisory-latest
- alias/GHSA-vx3p-948g-6vhq
- alias/CVE-2021-27290
- collector/github-advisory
- collector/redhat-cve
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/references
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- collector/ibm-support
- source/IBM
- agent/tags
- agent/trending
- package-manager/npm
- package-manager/redhat
- vendor/ssri project
- canonical/ssri project ssri
- version/ssri project ssri/5.2.2
- version/ssri project ssri/7.0.0
- vendor/oracle
- canonical/oracle graalvm
- version/oracle graalvm/20.3.3
- version/oracle graalvm/21.2.0
- vendor/siemens
- canonical/siemens sinec infrastructure network services
- vendor/ibm
- canonical/ibm engineering requirements quality assistant on-premises
- version/ibm engineering requirements quality assistant on-premises/all