The vulnerability of the fromUrl function in the hosted-git-info software, related to an incorrect regular expression, allows a hacker to trigger a service failure.

🗓️ 20 Jan 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Incorrect regex in hosted-git-info fromUrl triggers service failures.

Reporter	Title	Published	Views	Family All 174
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	30 Sep 202115:00	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-23362, CVE-2021-22918)	22 Apr 202214:12	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	25 Jun 202100:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	30 Mar 202316:06	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	20 Apr 202214:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affects IBM Netcool Agile Service Manager	1 Jun 202213:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	31 May 202214:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in React, webpack and Node.js modules affect Tivoli Netcool/OMNIbus WebGUI	6 Oct 202204:09	–	ibm

Vulners

Node

rebecca_turner node-hosted-git-infoRange2.0.0–2.8.9

OR

rebecca_turner node-hosted-git-infoRange3.0.0–3.0.8

Source	Link
github	www.github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
github	www.github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01
github	www.github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
github	www.github.com/npm/hosted-git-info/commits/v2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-23362
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-23362
snyk	www.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
snyk	www.snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1/

17 Oct 2022 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25

CVSS 35.3

EPSS0.00554

fromUrl function regular expression hosted git info service failures security vulnerability