En bref
- CVE-2022-35923 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant v8n (v8n project), v8n.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.8%, plus élevée que 78.2% des vulnérabilités.
- Correctif : mettre à jour vers 1.5.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| v8n | < 1.5.1
| 1.5.1
|
| v8n npm | < 1.5.1
| 1.5.1
|
Description
Impact
Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().
Patches
v1.5.1
References
huntr.dev report
Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking
For more information
If you have any questions or comments about this advisory:
NVD description
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free