Lucene search

GoogleOSV:CVE-2021-23425

HistoryAug 18, 2021 - 5:15 p.m.

CVE-2021-23425

2021-08-1817:15:08

Google

osv.dev

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

47.1%

JSON

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.

CPENameOperatorVersion
trim-off-newlineseq1.0.0
trim-off-newlineseq1.0.2
trim-off-newlineseq1.0.1

Name	Operator	Version
trim-off-newlines	eq	1.0.0
trim-off-newlines	eq	1.0.2
trim-off-newlines	eq	1.0.1

References

github.com/stevemao/trim-off-newlines/blob/master/index.js%23L6

snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1567197

snyk.io/vuln/SNYK-JS-TRIMOFFNEWLINES-1296850

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

47.1%

JSON

Related for OSV:CVE-2021-23425