PT-2019-20045 · Braces · Braces

Publicado 2019-06-06 · Atualizado 2019-06-06

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions braces versions prior to 2.3.1

Description The issue concerns Regular Expression Denial of Service (ReDoS) where untrusted input may cause catastrophic backtracking while matching regular expressions, leading to Denial of Service and causing the application to be unresponsive.

Recommendations Upgrade to version 2.3.1 or higher.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-185

Identificadores relacionados

GHSA-G95F-P29Q-9XW4

Produtos afetados

Braces

Referências · 4

• https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451 · Nota
• https://snyk.io/vuln/npm:braces:20180219 · Nota
• https://npmjs.com/advisories/786 · Nota
• https://osv.dev/vulnerability/GHSA-g95f-p29q-9xw4 · Aviso do Fabricante