Security Bulletin: API Connect minimatch CVE-2017-1556

Summary API Connect has addressed the following vulnerability. API Connect is vulnerable to a regular expression attack that could allow an authenticated attacker to use a regex and cause the system to slow or hang. Vulnerability Details CVEID: CVE-2017-1556 DESCRIPTION: IBM API Connect is...

boost/boost_regex_fuzzer: Crash in boost::re_detail_NUMBER::basic_regex_creator<char, boost::regex_traits<char, boo

Project: https://github.com/boostorg/boost.git Detailed report: https://oss-fuzz.com/testcase?key=5439484087762944 Project: boost Fuzzer: libFuzzerboostregexfuzzer Fuzz target binary: boostregexfuzzer Job Type: libfuzzerubsanboost Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

CVE-2018-8926

Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...

CVE-2018-8926

Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...

Privilege escalation

Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...

CVE-2018-8926

Synology Photo Station (affected versions: before 6.8.5-3471 and before 6.3-2975) contains a permissive regex vulnerability in synophoto_dsm_user that allows remote authenticated users to escalate privileges via the fullname parameter. The issue leads to high-impact results (C:H/I:H/A:H) per CVSS...

AZL-44400 CVE-2017-16137 affecting package js-jquery 3.5.0-4

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

DEBIAN-CVE-2017-16137

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

AZL-44772 CVE-2017-16137 affecting package nodejs-nodemon 2.0.3-5

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

AZL-44496 CVE-2017-16118 affecting package nodejs-nodemon 2.0.3-5

The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition...

AZL-44892 CVE-2017-16119 affecting package nodejs-nodemon 2.0.3-5

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition...

CVE-2017-16118

The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition...

CVE-2017-16115

The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds...

UBUNTU-CVE-2017-16137

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

UBUNTU-CVE-2017-16119

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition...

CVE-2017-16098

The CVE-2017-16098 issue concerns the charset package vulnerability (Regular Expression Denial of Service). The connected GHSA advisory confirms that affected versions are susceptible to ReDoS, with an observed ~2-second slowdown on 50,000-character inputs, and notes that if Node is built with -D...

CVE-2017-16136

CVE-2017-16136 affects the Node.js module method-override used with the Express.js framework. The issue is a regular expression denial of service (ReDoS) triggered when untrusted input is parsed via the X-HTTP-Method-Override header. In the provided documents, exploitation details are not describ...

CVE-2017-16114

CVE-2017-16114 affects the marked Markdown parser module. Vulnerable behavior is a regular expression denial of service when processing untrusted input; measurements report about 1,000 characters blocking the event loop for around 6 seconds. Affected environments are those that install the marked...

CVE-2017-16117

The CVE-2017-16117 issue affects the slug module (slugify strings, including unicode). Affected component: slug's regex-based parser vulnerable to Denial of Service when processing untrusted input. Impact: parsing untrusted input can cause the event loop to block for about 2 seconds, typically at...

riot-compiler denial of service vulnerability

riot-compiler is a compiler for riot user interface library. A security vulnerability exists in the regex in riot-compiler version 2.3.21. An attacker can exploit this vulnerability to cause a denial of service...