CVE-2021-23392 : The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.

Published 2021-06-08 08:15:07

Updated 2021-06-15 14:52:20

Source Snyk

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2021-23392

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 63 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-23392

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	3.9	1.4	Snyk
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

References for CVE-2021-23392

https://snyk.io/vuln/SNYK-JS-LOCUTUS-1090597

Regular Expression Denial of Service (ReDoS) in locutus | Snyk
Exploit;Patch;Third Party Advisory
https://github.com/locutusjs/locutus/commit/eb863321990e7e5514aa14f68b8d9978ece9e65e

Prevent ReDos issue with regex inside gopher_parsedir (#446) · locutusjs/locutus@eb86332 · GitHub
Patch;Third Party Advisory
https://github.com/locutusjs/locutus/pull/446

Prevent ReDos issue with regex inside gopher_parsedir by kukawski · Pull Request #446 · locutusjs/locutus · GitHub
Patch;Third Party Advisory

Products affected by CVE-2021-23392

Locutus » Locutus » For Node.js
Versions before (<) 2.0.15
cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:*
Matching versions