PT-2022-17572 · Terser+2 · Terser+2

Fábio Santos · Published 2022-07-15 · Updated 2024-07-04 · CVE-2022-25858

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions terser versions prior to 4.8.1 terser versions 5.0.0 through 5.14.2

Description The issue is related to a Denial of Service by Regular Expression (ReDoS) due to the insecure usage of regular expressions. This can lead to a service disruption.

Recommendations For versions prior to 4.8.1, update to version 4.8.1 or later. For versions 5.0.0 through 5.14.2, update to version 5.14.2 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

AZL-44460

AZL-44553

CVE-2022-25858

GHSA-4WF5-VPHF-C2XC

SNYK-JAVA-ORGWEBJARSNPM-2949722

SNYK-JS-TERSER-2806366

Affected Products

Debian

Red Os

Terser

References · 18

• 🔥 https://snyk.io/vuln/SNYK-JS-TERSER-2806366 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722 · Exploit
• https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b · Patch
• https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012 · Patch
• https://osv.dev/vulnerability/CVE-2022-25858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25858 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-25858 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44460 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-25858 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25858 · Security Note
• https://osv.dev/vulnerability/AZL-44553 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25858 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4wf5-vphf-c2xc · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25858 · Vendor Advisory
• https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135 · Note