CVE-2022-23514 Inefficient Regular Expression Complexity in Loofah

2022-12-1413:19:25

CWE-1333

GitHub_M

www.cve.org

cve-2022-23514

inefficient regular expression

loofah

nokogiri

svg attributes

denial of service

cpu resource consumption

patched

version 2.19.1

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

46.5%

JSON

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1.

CNA Affected

[
  {
    "vendor": "flavorjones",
    "product": "loofah",
    "versions": [
      {
        "version": "< 2.19.1",
        "status": "affected"
      }
    ]
  }
]