Описание
It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
Отчет
In Red Hat Quay the is-my-json-valid library is included as a build time dependency of protractor. It's only used at build time, not at runtime reducing the impact to low.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | nodejs-is-my-json-valid | Not affected | ||
| Red Hat Mobile Application Platform 4 | nodejs-is-my-json-valid | Affected | ||
| Red Hat OpenShift Enterprise 3 | nodejs-is-my-json-valid | Not affected | ||
| Red Hat Software Collections | rh-nodejs6-nodejs-is-my-json-valid | Will not fix | ||
| Red Hat Quay 3 | quay/quay-rhel8 | Fixed | RHSA-2021:3917 | 19.10.2021 |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
Regular expression deinal of service (ReDoS) in is-my-json-valid
Уязвимость библиотеки is-my-json-valid програмной платформы Node.js, позволяющая нарушителю вызвать отказ в обслуживании
5.3 Medium
CVSS3