uap-core Regular Expression Denial of Service issue

Description

An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string.

Recommendation

Update the uap-core package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.6.0
• Patched version(s): 0.6.0

References

• GHSA-fx7m-j728-mjw3
• www.x41-dsec.de
• CVE-2018-20164
• CWE-185
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in ssri - CVE-2018-7651
• Denial of Service in uap-core - CVE-2021-21317
• Denial of Service in uap-core when processing crafted User-Agent strings - CVE-2020-5243
• Regular Expression Denial of Service in highcharts (GHSA-xmc8-cjfr-phx3) - CVE-2018-20801

Tags:

npm

uap-core