| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| ua-parser-js | ≥ 0.7.30, < 0.7.33≥ 0.8.1, < 1.0.33 | 0.7.331.0.33 |
| ua-parser-js | ≥ 0.7.30, < 0.7.33≥ 0.8.0, < 1.0.33 | 0.7.331.0.33 |
A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js.
This vulnerability bypass the library's MAX_LENGTH input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.
From version 0.7.30 to before versions 0.7.33 / 1.0.33.
A patch has been released to remove the vulnerable regular expression, update to version 0.7.33 / 1.0.33 or later.
Regular expression Denial of Service - ReDoS
Thanks to @Snyk who first reported the issue.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí