PT-2021-3391 · Unknown · Color-String

Colin Ife + 1 · Published 2021-06-21 · Updated 2021-07-01 · CVE-2021-29060

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions color-string versions 1.5.5 and below

Description The issue is related to a Regular Expression Denial of Service (ReDOS) vulnerability in the color-string library, which can cause excessive resource consumption when processing crafted invalid HWB strings. This can lead to a denial of service. The vulnerability occurs due to exponential time complexity for linearly increasing input lengths for hwb() color strings, specifically in the regular expression that parses the hue value. The estimated processing time increases significantly with the length of the input string, with strings over 50,000 characters taking around 1.5 seconds to process.

Recommendations For color-string version 1.5.5 and below, consider disabling the hwb() function until a patch is available to prevent potential denial of service attacks. Restrict input lengths for hwb() color strings to minimize the risk of exploitation. Avoid using the hwb() function with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2021-03242

CVE-2021-29060

GHSA-257V-VJ4P-3W2H

Affected Products

Color-String

References · 15

• 🔥 https://github.com/yetingli/PoCs/blob/main/CVE-2021-29060/Color-String.md · Exploit
• https://github.com/Qix-/color-string/commit/0789e21284c33d89ebc4ab4ca6f759b9375ac9d3 · Patch
• https://osv.dev/vulnerability/GHSA-257v-vj4p-3w2h · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29060 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29060 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29060 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-29060 · Security Note
• https://bdu.fstec.ru/vul/2021-03242 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29060 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-29060 · Vendor Advisory
• https://github.com/Qix-/color-string/releases/tag/1.5.5 · Note
• https://github.com/yetingli/SaveResults/blob/main/js/color-string.js · Note
• https://access.redhat.com/security/cve/CVE-2021-29060 · Note
• https://npmjs.com/package/color-string · Note