CVE-2021-23362

🗓️ 23 Mar 2021 16:20:14Reported by snykType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 300 Views

The package hosted-git-info before 3.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js

Reporter	Title	Published	Views	Family All 174
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	30 Sep 202115:00	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-23362, CVE-2021-22918)	22 Apr 202214:12	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	25 Jun 202100:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	30 Mar 202316:06	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	20 Apr 202214:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affects IBM Netcool Agile Service Manager	1 Jun 202213:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	31 May 202214:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in React, webpack and Node.js modules affect Tivoli Netcool/OMNIbus WebGUI	6 Oct 202204:09	–	ibm

NVD

Node

npmjs hosted-git-infoRange2.0.0–2.8.9

npmjs hosted-git-infoRange3.0.0–3.0.8

Node

siemens sinec_infrastructure_network_servicesRange<1.0.1.1

[
  {
    "product": "hosted-git-info",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "3.0.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
snyk	www.snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
github	www.github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
github	www.github.com/npm/hosted-git-info/commits/v2
github	www.github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
snyk	www.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
github	www.github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01

21 Nov 2024 05:51Current

6.5Medium risk

Vulners AI Score6.5

CVSS 25

CVSS 3.15.3

EPSS0.00554

CWE-1333