PT-2021-21320 · Segment · Is-Email

Published 2021-07-14 · Updated 2022-05-03 · CVE-2021-36716

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Segment is-email package versions prior to 1.0.1

Description A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package for Node.js. An attacker able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU. The issue is related to the validation of email addresses.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the isEmail(input) function until a patch is available.

Fix

DoS

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

CVE-2021-36716

GHSA-J377-2X76-558H

Affected Products

Is-Email

References · 7

• https://osv.dev/vulnerability/GHSA-j377-2x76-558h · Vendor Advisory
• https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36716 · Security Note
• https://github.com/segmentio/is-email · Note
• https://github.com/segmentio/is-email/releases · Note
• https://t.me/cvenotify/17601 · Telegram Post