PT-2021-15450 · Unknown · Html-Parse-Stringify2+1

Yeting Li · Published 2021-03-04 · Updated 2021-03-18 · CVE-2021-23346

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions html-parse-stringify versions prior to 2.0.1 html-parse-stringify2 (affected versions not specified)

Description The issue arises when certain input is sent, causing one of the regular expressions used for parsing to backtrack, which can freeze the process.

Recommendations For html-parse-stringify versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. For html-parse-stringify2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-23346

GHSA-545Q-3FG6-48M7

SNYK-JAVA-ORGWEBJARSNPM-1080633

SNYK-JS-HTMLPARSESTRINGIFY-1079306

SNYK-JS-HTMLPARSESTRINGIFY2-1079307

Affected Products

Html-Parse-Stringify

Html-Parse-Stringify2

References · 10

• 🔥 https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1080633 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY-1079306 · Exploit
• https://github.com/HenrikJoreteg/html-parse-stringify/commit/c7274a48e59c92b2b7e906fedf9065159e73fe12 · Patch
• https://osv.dev/vulnerability/GHSA-545q-3fg6-48m7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23346 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23346 · Vendor Advisory
• https://github.com/HenrikJoreteg/html-parse-stringify/blob/master/lib/parse.js%23L2 · Note
• https://github.com/HenrikJoreteg/html-parse-stringify/releases/tag/v2.0.1 · Note
• https://github.com/rayd/html-parse-stringify2/blob/master/lib/parse.js%23L2 · Note