PT-2016-5193 · Unknown · Is-My-Json-Valid

Published 2016-02-23 · Updated 2018-07-31 · CVE-2016-2537

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions is-my-json-valid versions prior to 2.17.2 is-my-json-valid versions prior to 1.4.1

Description The issue is related to an incorrect regular expression in the is-my-json-valid package, which can cause a denial of service (blocked event loop) via a crafted string. This can be exploited by remote attackers. The vulnerability is also described as a regular expression denial of service (ReDoS) via the email validation function.

Recommendations Update to version 1.4.1 or later. Update to version 2.17.2 or later.

Fix

RCE

DoS

Weakness Enumeration

CWE-20

CWE-1333

Related Identifiers

CVE-2016-2537

GHSA-CCQ6-3QX5-VMQX

GHSA-F522-FFG8-J8R6

Affected Products

Is-My-Json-Valid

References · 15

• https://github.com/mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b · Patch
• https://osv.dev/vulnerability/GHSA-f522-ffg8-j8r6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2537 · Security Note
• https://osv.dev/vulnerability/GHSA-ccq6-3qx5-vmqx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2537 · Vendor Advisory
• https://github.com/github/advisory-database/pull/4850 · Note
• https://github.com/mafintosh/is-my-json-valid · Note
• https://github.com/mafintosh/is-my-json-valid/pull/159 · Note
• https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976 · Note
• https://hackerone.com/reports/317548 · Note
• https://npmjs.com/advisories/572 · Note
• https://npmjs.com/advisories/76 · Note
• https://github.com/advisories/GHSA-f522-ffg8-j8r6 · Note
• https://nodesecurity.io/advisories/76 · Note
• https://github.com/advisories/GHSA-ccq6-3qx5-vmqx · Note