CVE-2023-26103

Опубликовано: 25 фев. 2023

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

EPSS Низкий

Описание

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.

Ссылки

https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409
Broken Link
https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06
Patch
https://github.com/denoland/deno/pull/17722
Patch
https://github.com/denoland/deno/releases/tag/v1.31.0
Release Notes
https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970
Exploit
Technical Description
Third Party Advisory
https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409
Broken Link
https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06
Patch
https://github.com/denoland/deno/pull/17722
Patch
https://github.com/denoland/deno/releases/tag/v1.31.0
Release Notes
https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970
Exploit
Technical Description
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*

Версия до 1.31.0 (исключая)

EPSS

Процентиль: 32%

0.00123

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333

Связанные уязвимости

GHSA-jc97-h3h9-7xh6

CVSS3: 5.3

github

почти 3 года назад

Regular Expression Denial of Service in Deno.upgradeWebSocket API

EPSS

Процентиль: 32%

0.00123

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333