PT-2021-18260 · Unknown · Graphhopper

Karussell · Published 2021-05-13 · Updated 2021-05-24 · CVE-2021-29506

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: GraphHopper versions 2.0 through 2.3

Description: The issue is related to a regular expression injection that may lead to Denial of Service. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations: For GraphHopper versions 2.0 through 2.3, update to version 2.4 or 3.0 to resolve the issue. For versions lower than 2.x with the navigation module added, update to version 2.4 or 3.0 to resolve the issue. As a temporary workaround, consider disabling the navigation module in versions lower than 2.x until a patch is available.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-29506

GHSA-HF44-3MX6-VHHW

Affected Products

Graphhopper

References · 6

• https://github.com/graphhopper/graphhopper/commit/eb189be1fa7443ebf4ae881e737a18f818c95f41 · Patch
• https://github.com/graphhopper/graphhopper/pull/2304 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29506 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29506 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hf44-3mx6-vhhw · Vendor Advisory
• https://github.com/graphhopper/graphhopper/security/advisories/GHSA-hf44-3mx6-vhhw · Note