PT-2020-10877 · Handlebars · Handlebars

Published 2020-09-30 · Updated 2022-02-10 · CVE-2019-20922

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Handlebars versions prior to 4.4.5

Description The issue allows for Regular Expression Denial of Service (ReDoS) due to eager matching, which can cause the parser to enter an endless loop when processing crafted templates. This may enable attackers to exhaust system resources.

Recommendations For versions prior to 4.4.5, update to version 4.4.5 or later to resolve the issue.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2019-20922

GHSA-62GR-4QP9-H98F

RHSA-2020:5179

SNYK-JS-HANDLEBARS-480388

Affected Products

Handlebars

References · 10

• https://github.com/handlebars-lang/handlebars.js/commit/8d5530ee2c3ea9f0aee3fde310b9f36887d00b8b · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20922 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20922 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-20922 · Security Note
• https://osv.dev/vulnerability/GHSA-62gr-4qp9-h98f · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20922 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20922 · Vendor Advisory
• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-480388 · Note
• https://npmjs.com/package/handlebars · Note
• https://npmjs.com/advisories/1300 · Note