CVE-2022-25918

Опубликовано: 27 окт. 2022

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

EPSS Низкий

Описание

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.

Ссылки

https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52
Broken Link
https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9
Patch
Third Party Advisory
https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1
Release Notes
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108
Exploit
Patch
Third Party Advisory
https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52
Broken Link
https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9
Patch
Third Party Advisory
https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1
Release Notes
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:shescape_project:shescape:1.5.10:*:*:*:*:node.js:*:*

cpe:2.3:a:shescape_project:shescape:1.6.0:*:*:*:*:node.js:*:*

EPSS

Процентиль: 44%

0.00217

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333

Связанные уязвимости

GHSA-cr84-xvw4-qx3c

CVSS3: 7.5

github

больше 3 лет назад

Inefficient Regular Expression Complexity in shescape

EPSS

Процентиль: 44%

0.00217

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333