PT-2021-4017 · Prism · Prism

Published 2021-06-28 · Updated 2022-03-28 · CVE-2021-32723

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Prism versions prior to 1.24.0

Description The issue is related to Regular Expression Denial of Service (ReDoS) in some languages when Prism is used to highlight untrusted text. An attacker can craft a string that will take a very long time to highlight, potentially causing a denial of service. This problem can be exploited when Prism is used to highlight user-given text. As a workaround, it is recommended not to use ASCIIDoc or ERB to highlight untrusted text, as other languages are not affected and can be used safely.

Recommendations For versions prior to 1.24.0, update to Prism v1.24 to fix the issue. As a temporary workaround, consider not using ASCIIDoc or ERB to highlight untrusted text until the issue is resolved. Restrict the use of affected languages to minimize the risk of exploitation.

Fix

DoS

Improper Resource Release

Resource Exhaustion

Weakness Enumeration

CWE-404

CWE-400

Related Identifiers

BDU:2021-04543

CVE-2021-32723

GHSA-GJ77-59WH-66HG

Affected Products

Prism

References · 15

• https://github.com/PrismJS/prism/pull/2688 · Patch
• https://github.com/PrismJS/prism/pull/2774 · Patch
• https://cve.org/CVERecord?id=CVE-2021-32723 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32723 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32723 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://bdu.fstec.ru/vul/2021-04543 · Security Note
• https://ubuntu.com/security/CVE-2021-32723 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gj77-59wh-66hg · Vendor Advisory
• https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg · Note
• https://github.com/PrismJS/prism · Note
• https://github.com/PrismJS/prism/commit/d85e30da6755fdbe7f8559f8e75d122297167018 · Note
• https://vuldb.com/?id.177711 · Note
• https://t.me/cibsecurity/25766 · Telegram Post