PT-2021-4068 · Unknown+4 · Normalize-Url+4

Published 2021-05-21 · Updated 2023-08-08 · CVE-2021-33502

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions normalize-url versions 4.5.0 and earlier, 5.x before 5.3.1, and 6.x before 6.0.1

Description The issue is related to a ReDoS (regular expression denial of service) problem, which causes exponential performance for data: URLs. This can lead to uncontrolled resource consumption. An attacker could exploit this issue to cause a denial of service.

Recommendations For versions 4.5.0 and earlier, update to version 4.5.1 or later. For versions 5.x before 5.3.1, update to version 5.3.1 or later. For versions 6.x before 6.0.1, update to version 6.0.1 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

ALSA-2021:5171

ALSA-2022:0350

ALSA-2022:6595

AZL-44850

BDU:2021-04609

CESA-2021_5171

CESA-2022_0350

CVE-2021-33502

GHSA-PX4H-XG32-Q955

RHSA-2021:2931

RHSA-2021:2932

RHSA-2021:5171

RHSA-2021_5171

RHSA-2022:0246

RHSA-2022:0350

RHSA-2022:4711

RHSA-2022:6595

RHSA-2022_0350

RHSA-2022_6595

RLSA-2021:5171

RLSA-2022:0350

RLSA-2022:6595

Affected Products

Almalinux

Centos

Red Hat

Rocky Linux

Normalize-Url

References · 80

• https://nvd.nist.gov/vuln/detail/CVE-2021-33502 · Security Note
• https://ubuntu.com/security/CVE-2021-33502 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2022-6595.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-6595.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33502 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/684400 · Security Note
• https://errata.rockylinux.org/RLSA-2022:6595 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-0350.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33502 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44850 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:5171 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:0350 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-0350.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:6595 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-px4h-xg32-q955 · Vendor Advisory