Описание
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the lowercase() and uppercase() regex which could lead to a denial of service attack. In testing of the lowercase() function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.
Ссылки
- PatchThird Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.5.1 (исключая)
cpe:2.3:a:v8n_project:v8n:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 36%
0.00149
Низкий
7.5 High
CVSS3
Дефекты
CWE-400
CWE-1333
Связанные уязвимости
CVSS3: 7.5
github
больше 3 лет назад
v8n vulnerable to Inefficient Regular Expression Complexity
EPSS
Процентиль: 36%
0.00149
Низкий
7.5 High
CVSS3
Дефекты
CWE-400
CWE-1333