PT-2021-17444 · Npm · @Progfay/Scrapbox-Parser

Progfay · Published 2021-02-19 · Updated 2021-03-30 · CVE-2021-27405

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions @progfay/scrapbox-parser versions prior to 6.0.3 @progfay/scrapbox-parser versions prior to 7.0.2

Description A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package for Node.js. This issue allows an attacker to cause the application to consume an excessive amount of CPU by parsing specially crafted text.

Recommendations For versions prior to 6.0.3, upgrade to version 6.0.3 or later. For versions prior to 7.0.2, upgrade to version 7.0.2 or later. As a temporary workaround, avoid parsing text with a lot of [ characters to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-27405

GHSA-9FHW-R42P-5C7R

Affected Products

@Progfay/Scrapbox-Parser

References · 10

• https://github.com/progfay/scrapbox-parser/pull/539 · Patch
• https://github.com/progfay/scrapbox-parser/pull/540 · Patch
• https://github.com/progfay/scrapbox-parser/pull/519 · Patch
• https://osv.dev/vulnerability/CVE-2021-27405 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9fhw-r42p-5c7r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27405 · Security Note
• https://github.com/progfay/scrapbox-parser/security/advisories/GHSA-9fhw-r42p-5c7r · Note
• https://security.netapp.com/advisory/ntap-20210326-0002 · Note
• https://t.me/cvenotify/12026 · Telegram Post
• https://t.me/cvenotify/10128 · Telegram Post