Regular Expression Denial of Service in path-parse

Affected versions of npm package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...

OPENSUSE-SU-2021:1134-1 Security update for python-CairoSVG, python-Pillow

This update for python-CairoSVG, python-Pillow fixes the following issues: Update to version 2.5.1. Security fix: When processing SVG files, CairoSVG was using two regular expressions which are vulnerable to Regular Expression Denial of Service REDoS. If an attacker provided a malicious SVG, it...

Moderate: nodejs:12 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 12.22.3. BZ1978201 Security Fixes: nodejs-hosted-git-info: Regular Expression denial...

Security update for python-CairoSVG, python-Pillow (moderate)

openSUSE Security Update: Security update for python-CairoSVG, python-Pillow Announcement ID: openSUSE-SU-2021:1134-1 Rating: moderate References: 1180832 1180833 1180834 1181281 Cross-References: CVE-2020-15999 CVE-2020-35653 CVE-2020-35654 CVE-2020-35655 CVE-2021-25289 CVE-2021-25290...

OPENSUSE-SU-2021:1113-1 Security update for nodejs8

This update for nodejs8 fixes the following issues: - update to npm 6.14.13 - CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. bsc1187976 - CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. bsc1187977 - CVE-2020-7774: fixes y18n Prototype Pollution...

SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2021:2326-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2326-1 advisory. - update to 12.22.2: - CVE-2021-22918: Out of bounds read bsc1187973 - CVE-2021-23362: ssri Regular Expression Denial of Service and...

SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2021:2620-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2620-1 advisory. - update to npm 6.14.13 - CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. bsc1187976 - CVE-2021-23362: Fixed...

SUSE-SU-2021:2620-1 Security update for nodejs8

This update for nodejs8 fixes the following issues: - update to npm 6.14.13 - CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. bsc1187976 - CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service bsc1187977 - CVE-2021-22884: DNS rebinding in --inspect bsc1182620...

OPENSUSE-SU-2021:2618-1 Security update for nodejs8

This update for nodejs8 fixes the following issues: - update to npm 6.14.13 - CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. bsc1187976 - CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. bsc1187977 - CVE-2020-7774: fixes y18n Prototype Pollution...

SUSE-SU-2021:2618-1 Security update for nodejs8

This update for nodejs8 fixes the following issues: - update to npm 6.14.13 - CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. bsc1187976 - CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. bsc1187977 - CVE-2020-7774: fixes y18n Prototype Pollution...

Regular Expression Denial of Service in Addressable templates

...

nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...

nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode

A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service ReDoS. This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability...

Moderate: Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

An update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...

nodejs-normalize-url: ReDoS for data URLs

A flaw was found in normalize-url. Node.js has a ReDoS regular expression denial of service issue because it has exponential performance for data...

nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode

A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service ReDoS. This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability...

RHEL 7 : rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon (RHSA-2021:2932)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2932 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

Regular Expression Denial Of Service (ReDoS)

react-native is vulnerable to regular expression denial of service.An attacker is able to crash the system by submitting a crafted URL via the validateBaseUrl function...

nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe

A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...