PT-2019-20068 · Epeli · Underscore.String

Publicado 2019-06-14 · Atualizado 2019-06-14

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions underscore.string versions prior to 3.3.5

Description The issue concerns a Regular Expression Denial of Service (ReDoS) in the unescapeHTML function due to an overly-broad regex. This results in a slowdown that grows exponentially with larger inputs, approximately 2s for 50,000 characters.

Recommendations Upgrade to version 3.3.5 or higher.

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

GHSA-V2P6-4MP7-3R9V

Produtos afetados

Underscore.String

Referências · 5

• https://github.com/epeli/underscore.string/pull/517 · Nota
• https://github.com/epeli/underscore.string/issues/510 · Nota
• https://github.com/epeli/underscore.string/commit/f486cd684c94c12db48b45d52b1472a1b9661029 · Nota
• https://npmjs.com/advisories/745 · Nota
• https://osv.dev/vulnerability/GHSA-v2p6-4mp7-3r9v · Aviso do Fabricante