PT-2022-14197 · Devcert · Devcert

Denys Vozniuk · Published 2022-06-01 · Updated 2023-07-24 · CVE-2022-1929

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions devcert (affected versions not specified)

Description The issue is related to an exponential ReDoS (Regular Expression Denial of Service) that can be triggered when an attacker supplies arbitrary input to the certificateFor method.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2022-1929

GHSA-FP36-299X-PWMW

Affected Products

Devcert

References · 6

• 🔥 https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352 · Exploit
• https://osv.dev/vulnerability/GHSA-fp36-299x-pwmw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1929 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1929 · Vendor Advisory
• https://github.com/davewasmer/devcert · Note
• https://github.com/davewasmer/devcert/commit/b0763215f6683271d296fda98f7ef7bcd4a55977 · Note