PT-2021-19964 · Unknown · Rocket.Chat

Erik Krogh Kristensen · Published 2021-08-30 · Updated 2021-09-08 · CVE-2021-32832

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 3.11.3 Rocket.Chat versions prior to 3.12.2 Rocket.Chat versions prior to 3.13

Description The issue is related to certain regular expressions in Rocket.Chat, which could potentially lead to Denial of Service. Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript.

Recommendations For versions prior to 3.11.3, update to version 3.11.3 or later. For versions prior to 3.12.2, update to version 3.12.2 or later. For versions prior to 3.13, update to version 3.13 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-32832

Affected Products

Rocket.Chat

References · 7

• 🔥 https://securitylab.github.com/advisories/GHSL-2020-310-redos-Rocket.Chat · Exploit
• https://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094c · Patch
• https://osv.dev/vulnerability/CVE-2021-32832 · Vendor Advisory
• https://docs.rocket.chat/guides/security/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32832 · Security Note
• https://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3 · Note
• https://t.me/cibsecurity/28050 · Telegram Post