CVE-2022-24373

🗓️ 30 Sep 2022 05:00:17Reported by snykType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 61 Views

The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js

Reporter	Title	Published	Views	Family All 13
CNNVD	react-native-reanimated 资源管理错误漏洞	30 Sep 202200:00	–	cnnvd
Cvelist	CVE-2022-24373 Regular Expression Denial of Service (ReDoS)	30 Sep 202205:00	–	cvelist
EUVD	EUVD-2022-6990	3 Oct 202520:07	–	euvd
Github Security Blog	react-native-reanimated vulnerable to ReDoS	1 Oct 202200:00	–	github
NVD	CVE-2022-24373	30 Sep 202205:15	–	nvd
OSV	GHSA-2J79-8PQC-R7X6 react-native-reanimated vulnerable to ReDoS	1 Oct 202200:00	–	osv
Prion	Design/Logic Flaw	30 Sep 202205:15	–	prion
Positive Technologies	PT-2022-16652 · Unknown +1 · React-Native-Reanimated +1	30 Sep 202200:00	–	ptsecurity
Snyk	Regular Expression Denial of Service (ReDoS)	13 Jul 202214:50	–	snyk
Veracode	Regular Expression Denial Of Service (ReDoS)	3 Oct 202210:02	–	veracode

NVD

Node

swmansion react_native_reanimatedRange<2.10.0

[
  {
    "product": "react-native-reanimated",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "3.0.0-rc.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
security	www.security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507
github	www.github.com/software-mansion/react-native-reanimated/pull/3382
github	www.github.com/software-mansion/react-native-reanimated/pull/3382/commits/7adf06d0c59382d884a04be86a96eede3d0432fa
github	www.github.com/software-mansion/react-native-reanimated/releases/tag/3.0.0-rc.1