PT-2020-19788 · Unknown · Djvalidator

Yeting Li · Published 2020-11-26 · Updated 2022-02-09 · CVE-2020-7779

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions djvalidator versions all

Description The issue is related to Regular Expression Denial of Service (ReDoS) in djvalidator. This occurs when crafted invalid emails are sent, such as --@------------------------------------------------------------------------------------------------------------------------!. The ReDoS vulnerability can be exploited by sending specially crafted input to the email validation function, causing a denial of service.

Recommendations For all versions, consider temporarily disabling the email validation function until a patch is available. Restrict access to the email validation module to minimize the risk of exploitation. Avoid using the email validation function with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-7779

GHSA-V6WH-2WVH-C8X5

SNYK-JS-DJVALIDATOR-1018709

Affected Products

Djvalidator

References · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-DJVALIDATOR-1018709 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7779 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7779 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v6wh-2wvh-c8x5 · Vendor Advisory
• https://t.me/cibsecurity/16865 · Telegram Post
• https://t.me/cvenotify/6241 · Telegram Post