PT-2021-14414 · Uap-Core · Uap-Core

Published 2021-02-02 · Updated 2024-02-08 · CVE-2021-21317

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions uap-core versions prior to 0.11.0

Description The issue concerns regular expression denial of service (REDoS) due to overlapping capture groups in some regexes. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

Recommendations For versions prior to 0.11.0, update uap-core to version 0.11.0 or later. As a temporary workaround, consider restricting access to the User-Agent header in HTTP(S) requests until the issue is resolved.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CVE-2021-21317

GHSA-P4PJ-MG4R-X6V4

Affected Products

Uap-Core

References · 12

• https://github.com/ua-parser/uap-core/commit/dc9925d458214cfe87b93e35346980612f6ae96c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21317 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-21317 · Security Note
• https://ubuntu.com/security/CVE-2021-21317 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21317 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21317 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p4pj-mg4r-x6v4 · Vendor Advisory
• https://github.com/ua-parser/uap-core/security/advisories/GHSA-p4pj-mg4r-x6v4 · Note
• https://github.com/ua-parser/uap-core · Note
• https://npmjs.com/package/uap-core · Note
• https://t.me/cvenotify/9994 · Telegram Post
• https://t.me/cibsecurity/23661 · Telegram Post