Denial of Service in uap-core

Description

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

Recommendation

Update the uap-core package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.11.0
• Patched version(s): 0.11.0

References

• GHSA-p4pj-mg4r-x6v4
• www.npmjs.com
• CVE-2021-21317
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• uap-core Regular Expression Denial of Service issue - CVE-2018-20164
• Denial of Service in uap-core when processing crafted User-Agent strings - CVE-2020-5243
• prismjs Regular Expression Denial of Service vulnerability - CVE-2021-3801
• Regular Expression Denial of Service (REDoS) in Marked - CVE-2021-21306

Tags:

npm

uap-core