Regular Expression Denial of Service in hosted-git-info

Description

The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity

Recommendation

Update the hosted-git-info package to the latest compatible version. Followings are version details:

• Affected version(s): **< 2.8.9

  >= 3.0.0, < 3.0.8**

• Patched version(s): **2.8.9

  3.0.8**

References

• GHSA-43f8-2h32-f4cj
• snyk.io
• cert-portal.siemens.com
• CVE-2021-23362
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-image - CVE-2021-21391
• Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-font - CVE-2021-21391
• Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-engine - CVE-2021-21391
• Regular expression Denial of Service in @progfay/scrapbox-parser - CVE-2021-27405

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

hosted-git-info