PT-2020-6059 · Github · Ua-Parser-Js

Yeting Li · Published 2020-09-16 · Updated 2022-10-07 · CVE-2020-7733

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ua-parser-js versions prior to 0.7.22

Description The issue is related to an uncontrolled resource consumption vulnerability in the ua-parser-js library. It may allow a remote attacker to cause a denial of service. The vulnerability is due to a Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.

Recommendations For versions prior to 0.7.22, update to version 0.7.22 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable regex for Redmi Phones and Mi Pad Tablets UA until a patch is available.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2021-02864

CVE-2020-7733

GHSA-662X-FHQG-9P8V

RHSA-2021:2865

RHSA-2021:4626

SNYK-JAVA-ORGWEBJARSBOWERGITHUBFAISALMAN-674666

SNYK-JAVA-ORGWEBJARSNPM-674665

SNYK-JS-UAPARSERJS-610226

Affected Products

Ua-Parser-Js

References · 12

• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-674665 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-UAPARSERJS-610226 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBFAISALMAN-674666 · Exploit
• https://github.com/faisalman/ua-parser-js/commit/233d3bae22a795153a7e6638887ce159c63e557d · Patch
• https://ubuntu.com/security/CVE-2020-7733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7733 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7733 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7733 · Security Note
• https://osv.dev/vulnerability/GHSA-662x-fhqg-9p8v · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02864 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7733 · Vendor Advisory
• https://oracle.com//security-alerts/cpujul2021.html · Note