CVE-2021-29060

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/204156
• https://www.ibm.com/support/pages/node/6517470 (Advisory)
• https://github.com/Qix-/color-string/commit/0789e21284c33d89ebc4ab4ca6f759b9375ac9d3
• https://github.com/yetingli/PoCs/blob/main/CVE-2021-29060/Color-String.md
• https://github.com/yetingli/SaveResults/blob/main/js/color-string.js
• https://www.npmjs.com/package/color-string

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6517470

Frequently Asked Questions

• What is CVE-2021-29060?

  CVE-2021-29060 is a Regular Expression Denial of Service (ReDOS) vulnerability discovered in Color-String.

• What is the severity of CVE-2021-29060?

  The severity of CVE-2021-29060 is high with a CVSS score of 7.5.

• How does CVE-2021-29060 affect Color-String?

  CVE-2021-29060 affects Color-String by causing a denial of service when a crafted invalid HWB string is provided and checked by the application.

• How can a remote attacker exploit CVE-2021-29060?

  A remote attacker can exploit CVE-2021-29060 by sending a specially crafted string to cause a regular expression denial of service.

• Is there a fix available for CVE-2021-29060?

  Yes, a fix for CVE-2021-29060 is available. It is recommended to update Color-String to a version beyond 1.5.5.