PT-2023-33000 · Unknown · Http-Cache-Semantics+1

Published 2023-02-11 · Updated 2023-02-11

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions http-cache-semantics versions prior to 4.1.1 cacheable-request versions prior to 10.2.7

Description The issue is related to an Inefficient Regular Expression Complexity in http-cache-semantics, which can lead to Denial of Service. This can be exploited via malicious request header values sent to a server when the server reads the cache policy from the request using this library.

Recommendations For http-cache-semantics versions prior to 4.1.1, update to version 4.1.1 or later. For cacheable-request versions prior to 10.2.7, update to version 10.2.7 or later.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

GHSA-8X6C-CV3V-VP6G

Affected Products

Cacheable-Request

Http-Cache-Semantics

References · 5

• https://osv.dev/vulnerability/GHSA-8x6c-cv3v-vp6g · Vendor Advisory
• ❌ https://github.com/jaredwray/cacheable-request/commit/8a47777e4eb61960469873cf4b3a2823742fc15e · Note, Deleted
• https://github.com/advisories/GHSA-rc47-6667-2j5j · Note
• ❌ https://github.com/jaredwray/cacheable-request/security/advisories/GHSA-8x6c-cv3v-vp6g · Note, Deleted
• ❌ https://github.com/jaredwray/cacheable-request · Note, Deleted