CLSA-2022-1654526367 Fixed CVEs in python-setuptools_scm-6.module_el8.5.0+2050+77770ab7: CVE-2021-4189, CVE-2022-0391, CVE-2021-3733, CVE-2021-3737

CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler rhbz2047376 - CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2047376 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2047376 - CVE-2022-0391: urllib.parse...

Regular Expression Denial of Service (ReDoS)

Description Affected versions of the package are vulnerable to Regular Expression Denial of Service ReDoS attacks for any string input controlled by the user. An attacker can provide a specially crafted input to the default function moment, which nearly matches the pattern being matched. This wil...

Regular Expression Denial Of Service (ReDoS)

semver-regex is vulnerable to regular expression denial of service. The vulnerability exists in semverRegex function in index.js due to improper use of regular expressions which allows an attacker to cause a ReDos...

Regular Expression Denial Of Service (ReDoS)

markdown-link-extractor is vulnerable to regular expression denial of service. An attacker can crash the application by providing malicious input to the module.exports function of index.js due to the insecure regex pattern used for the image parameter...

GHSA-FP36-299X-PWMW Regular expression denial of service in devcert

An exponential ReDoS Regular Expression Denial of Service can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method...

Regular expression denial of service in markdown-link-extractor

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

GHSA-J9M2-H2PV-WVPH Regular expression denial of service in jquery-validation

An exponential ReDoS Regular Expression Denial of Service can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method...

Regular expression denial of service in jquery-validation

An exponential ReDoS Regular Expression Denial of Service can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method...

CVE-2021-43308

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

CVE-2021-43308

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...

CVE-2021-43306

An exponential ReDoS Regular Expression Denial of Service can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method...

CVE-2021-43307

An exponential ReDoS Regular Expression Denial of Service can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test method...

CVE-2021-43307

An exponential ReDoS Regular Expression Denial of Service can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test method...

Devcert 安全漏洞

Devcert is a package for SSL development from npm, Inc. A denial of service vulnerability exists in versions prior to Devcert 1.2.1, which stems from triggering an exponential ReDoS regular expression denial of service in the Devcert package. An attacker could exploit this vulnerability to cause ...

Design/Logic Flaw

BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service ReDoS attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5...

CVE-2022-1929

CVE-2022-1929 affects the npm package devcert. Affected component: the certificateFor function and the underlying regex patterns for VALID_IP/VALID_DOMAIN, leading to an exponential ReDoS (Denial of Service) when attacker-controlled input is provided. Public sources describe a denial of service a...

CVE-2021-43307 Exponential ReDoS in semver-regex

An exponential ReDoS Regular Expression Denial of Service can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test method...

CVE-2021-43306

The CVE-2021-43306 entry concerns the jQuery Validation Plugin (jquery-validation). The vulnerability is a Regular Expression Denial of Service (ReDoS) triggered when an attacker can supply arbitrary input to the url2 method, due to an incomplete fix for CVE-2021-43306. Affected versions are thos...

CVE-2021-43306 Exponential ReDoS in jquery-validation

An exponential ReDoS Regular Expression Denial of Service can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method...

Regular expression denial of service in apache tika

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only...