CVE-2021-3807

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

EulerOS 2.0 SP8 : python-jinja2 (EulerOS-SA-2021-2482)

According to the versions of the python-jinja2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator a...

Ubuntu 21.04 : SQL parse vulnerability (USN-5085-1)

The remote Ubuntu 21.04 host has packages installed that are affected by a vulnerability as referenced in the USN-5085-1 advisory. It was discovered that SQL parse incorrectly handled certain regular expression. An attacker could possibly use this issue to cause a denial of service. Tenable has...

Inefficient Regular Expression Complexity in tapjs/tap-mocha-reporter

Description I would like to report a Regular Expression Denial of Service ReDoS vulnerability in tap-mocha-reporter. The ReDoS vulnerability is mainly due to the regex /^\s+|\s+$|/g and can be exploited with the following code. Proof of Concept // PoC.js var tapMochaReporter =...

nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe

A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...

Inefficient Regular Expression Complexity in validatorjs/validator.js

Description I would like to report a Regular Expression Denial of Service ReDoS vulnerability in validator. It allows cause a denial of service when calling function 'rtrim'. The ReDoS vulnerability is mainly due to the regex /\s+$/g and can be exploited with the following code. Proof of Concept ...

CVE-2021-39229

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin which just comes out of the box are subject to a denial of service attac...

GHSA-QHMP-H54X-38QR Apprise vulnerable to regex injection with IFTTT Plugin

Impact Anyone publicly hosting the Apprise library and granting them access to the IFTTT notification service. Patches Update to Apprise v0.9.5.1 bash Install Apprise v0.9.5.1 from PyPI pip install apprise==0.9.5.1 The patch to the problem was performed here. Workarounds Alternatively, if upgradi...

Apprise vulnerable to regex injection with IFTTT Plugin

Impact Anyone publicly hosting the Apprise library and granting them access to the IFTTT notification service. Patches Update to Apprise v0.9.5.1 bash Install Apprise v0.9.5.1 from PyPI pip install apprise==0.9.5.1 The patch to the problem was performed here. Workarounds Alternatively, if upgradi...

Inefficient Regular Expression Complexity in nth-check

There is a Regular Expression Denial of Service ReDoS vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks. The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern \s?:+-?\s\d+? with quantified overlapping adjacency and can be...

08cms (=1.0.0), 1-test-gulp-1 (>=0.0.1 <=0.0.4) +6853 more potentially affected by CVE-2021-3795 via semver-regex (>=0.1.1 <=3.1.2)

semver-regex NPM version =0.1.1, =0.0.1, =1.0.0, =3.1.4, =1.0.3, =1.0.0, =3.1.6, =0.0.1, =1.0.0, =1.0.0, =1.1.2 - 3vot-clay =2.0.1 - 433bf =0.0.1 and more Source cves: CVE-2021-3795 Source advisory: OSV:GHSA-44C6-4V22-4MHX...

GHSA-JGRX-MGXX-JF9V tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion

nodejs-tmpl is simple string formatting. tmpl is vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion...

@bdehamer/foo-a (>=0.1.0 <=0.1.1), @platform/cell.cli (=0.2.277) +10 more potentially affected by CVE-2021-3807 via ansi-regex (=6.0.0)

ansi-regex NPM version =6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansi-regex and may be impacted: - @bdehamer/foo-a =0.1.0, =0.1.1 - @platform/cell.cli =0.2.277 - @platform/cell.fs.sync =0.3.273 - @platform/cell.service =0.8.41 -...

@asiachan/ui-h5 (>=0.0.1 <=0.0.12), @asiachan/ui-h5-test (=0.0.1) +57 more potentially affected by CVE-2021-3807 via ansi-regex (=5.0.0)

ansi-regex NPM version =5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansi-regex and may be impacted: - @asiachan/ui-h5 =0.0.1, =0.2.16, =3.0.1-1.0, =1.0.0, =2.1.6, =0.0.0, =0.0.25, =0.0.0, =0.0.19, =0.8.5, =0.8.40 and more Source cves:...

abt.api.web (=0.0.3) potentially affected by CVE-2021-3807 via ansi-regex (=3.0.0)

ansi-regex NPM version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansi-regex and may be impacted: - abt.api.web =0.0.3 Source cves: CVE-2021-3807 Source advisory: OSV:GHSA-93Q8-GQ69-WQMW...

@codedungeon/gunner (>=0.38.0 <=0.80.1), @codedungeon/laravel-versions-cli (=0.1.0) +22 more potentially affected by CVE-2021-3807 via ansi-regex (>=4.0.0 <=4.1.0)

ansi-regex NPM version =4.0.0, =0.38.0, =0.0.65, =0.0.0, =0.0.41, =0.0.12, =0.0.0, =0.2.0, =3.3.69, =0.0.3, =0.2.11, =5.1.0, =4.0.58, =3.0.58, =6.0.17, =6.1.110 and more Source cves: CVE-2021-3807 Source advisory: OSV:GHSA-93Q8-GQ69-WQMW...

Inefficient Regular Expression Complexity in chalk/ansi-regex

ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes. Proof of Concept js import ansiRegex from 'ansi-regex'; forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = "\u001B"+";".repeati10000...

PYSEC-2021-325

Flask-RESTX pypi package flask-restx is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS Regular Expression Denial of Service in emailregex. This is fixed in version 0.5.1...

Design/Logic Flaw

Flask-RESTX pypi package flask-restx is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS Regular Expression Denial of Service in emailregex. This is fixed in version 0.5.1...

PYSEC-2021-325

Flask-RESTX pypi package flask-restx is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS Regular Expression Denial of Service in emailregex. This is fixed in version 0.5.1...