PT-2017-4098 · Microsoft · Uglify-Js
Published
2017-01-23
·
Updated
2021-05-25
·
CVE-2015-8858
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
uglify-js versions prior to 2.6.0
Description
The issue allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, also known as a "regular expression denial of service (ReDoS)". This can be exploited by passing malicious inputs into the
parse() method, leading to uncontrolled resource consumption. A remote attacker can use a specially crafted regular expression to achieve a denial of service.Recommendations
Update to version 2.6.0 or later. As a temporary workaround, consider restricting the use of the
parse() method until a patch is available. Avoid using the parse() method with untrusted input to minimize the risk of exploitation.Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Uglify-Js