CVE-2022-25883

Опубликовано: 21 июн. 2023

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

EPSS Низкий

Описание

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Ссылки

https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
Broken Link
https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
Broken Link
https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
Broken Link
https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
Patch
Third Party Advisory
https://github.com/npm/node-semver/pull/564
Patch
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
Exploit
Patch
Third Party Advisory
https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
Broken Link
https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
Broken Link
https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
Broken Link
https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
Patch
Third Party Advisory
https://github.com/npm/node-semver/pull/564
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20241025-0004/
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:npmjs:semver:*:*:*:*:*:node.js:*:*

Версия до 5.7.2 (исключая)

cpe:2.3:a:npmjs:semver:*:*:*:*:*:node.js:*:*

Версия от 6.0.0 (включая) до 6.3.1 (исключая)

cpe:2.3:a:npmjs:semver:*:*:*:*:*:node.js:*:*

Версия от 7.0.0 (включая) до 7.5.3 (исключая)

EPSS

Процентиль: 55%

0.00321

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333

Связанные уязвимости

CVE-2022-25883

CVSS3: 5.3

ubuntu

больше 2 лет назад

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

CVE-2022-25883

CVSS3: 7.5

redhat

больше 2 лет назад

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

CVE-2022-25883

CVSS3: 7.5

msrc

больше 2 лет назад

Описание отсутствует

CVE-2022-25883

CVSS3: 5.3

debian

больше 2 лет назад

Versions of the package semver before 7.5.2 are vulnerable to Regular ...

GHSA-c2qf-rxjj-qqgw

CVSS3: 7.5

github

больше 2 лет назад

semver vulnerable to Regular Expression Denial of Service

EPSS

Процентиль: 55%

0.00321

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333