PT-2018-12230

Name of the Vulnerable Software and Affected Versions MongoDB bson JavaScript module versions 0.5.0 through 1.0.4 Description The issue is related to a Regular Expression Denial of Service ReDoS in the lib/bson/decimal128.js file. It occurs when the Decimal128.fromString function is used to parse...

Security Bulletin: Two ReDoS vulnerabilities in modules included in the Node.js npm tool

Summary Two ReDoS vulnerabilities in modules included in the Node.js npm tool shipped by IBM Rational Application Developer for WebSphere Software. Vulnerability Details CVEID: CVE-2016-2515 DESCRIPTION: Node.JS hawk is vulnerable to a denial of service, caused by an error in the regular expressi...

Regular Expression Denial Of Service (ReDoS)

no-case is vulnerable to regular expression denial of service ReDoS attacks. The library does not properly sanitize user input strings, causing slowdown when matching strings that can lead to a ReDoS...

Regular Expression Denial Of Service (ReDoS)

charset is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a string to the through the HTTP header to cause a ReDoS attack...

Regular Expression Denial Of Service (ReDoS)

ua-parser is vulnerable to regular expression denial of service ReDoS. A malicious user can pass a string through the User-Agent header to cause a ReDoS...

Regular Expression Denial Of Service (ReDoS)

method-override is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability exists when parsing malicious X-HTTP-Method-Override header...

spring-framework: ReDoS Attack with spring-messaging

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

DEBIAN-CVE-2018-3737

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...

CVE-2018-3737

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

CVE-2018-3737

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...

CVE-2017-16086

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...

Code injection

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

Code injection

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...

Default credentials

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb, so the impact of the ReDoS is...

Design/Logic Flaw

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...

CVE-2018-3737

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...

CVE-2018-3737

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...