CVE-2020-1920

Опубликовано: 01 июн. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.

Ссылки

https://github.com/facebook/react-native/commit/ca09ae82715e33c9ac77b3fa55495cf84ba891c7
Patch
Third Party Advisory
https://github.com/facebook/react-native/releases/tag/v0.64.1
Release Notes
Third Party Advisory
https://github.com/facebook/react-native/commit/ca09ae82715e33c9ac77b3fa55495cf84ba891c7
Patch
Third Party Advisory
https://github.com/facebook/react-native/releases/tag/v0.64.1
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:facebook:react-native:*:*:*:*:*:*:*:*

Версия от 0.59.0 (включая) до 0.64.1 (исключая)

EPSS

Процентиль: 43%

0.00208

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-1333

CWE-697

Связанные уязвимости

GHSA-7f53-fmmv-mfjv