Описание
(ReDoS) Regular Expression Denial of Service in tf2-item-format
Summary
Versions of tf2-item-format since at least 4.2.6 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input.
Tested Versions
5.9.135.8.105.7.05.6.174.3.54.2.6
v5
Upgrade package to ^5.9.14
v4
No patch exists. Please consult the v4 to v5 migration guide to upgrade to v5.
If upgrading to v5 is not possible, fork the module repository and implement the fix detailed below.
Impact
This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any tf2-item-format to parse user input.
Ссылки
Пакеты
tf2-item-format
>= 4.2.6, <= 5.9.13
5.9.14
EPSS
8.7 High
CVSS4
7.5 High
CVSS3
CVE ID
Дефекты
Связанные уязвимости
TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.
EPSS
8.7 High
CVSS4
7.5 High
CVSS3