요약
- CVE-2022-35923은(는) v8n (v8n project), v8n에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.8%, 전체 취약점의 78.2%보다 높음.
- 조치: 1.5.1 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| v8n | < 1.5.1
| 1.5.1
|
| v8n npm | < 1.5.1
| 1.5.1
|
Description
Impact
Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().
Patches
v1.5.1
References
huntr.dev report
Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking
For more information
If you have any questions or comments about this advisory:
NVD description
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free