Denial of Service in jquery

Description

Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.

Recommendation

Update the jquery package to the latest compatible version. Followings are version details:

• Affected version(s): = 3.0.0-rc.1
• Patched version(s): 3.0.0

References

• GHSA-mhpp-875w-9cpv
• www.npmjs.com
• snyk.io
• CVE-2016-10707
• CWE-400
• CWE-674
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Command Injection in lodash - CVE-2021-23337
• Potential XSS vulnerability in jQuery - CVE-2020-11023
• Potential XSS vulnerability in jQuery (GHSA-gxr4-xjj5-5px2) - CVE-2020-11022
• XSS in jQuery as used in Drupal, Backdrop CMS, and other products - CVE-2019-11358

Tags:

npm

jquery