Security Bulletin: App Connect Enterprise Certified Container Designer instances may be vulnerable to CVE-2020-7760

Summary Some flow editor dialogs in a Designer instance App Connect Enterprise Certified Container may be vulnerable to a regular expression denial of service flaw that could make that Designer instance unresponsive. Vulnerability Details CVEID: CVE-2020-7760 DESCRIPTION: Node.js codemirror modul...

CVE-2020-7761 Regular Expression Denial of Service (ReDoS)

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails...

squid: Improper access restriction in url_regex may lead to security bypass

A flaw was found in squid. The Cache Manager for Squid has rules that, by default, block access to anyone other than the maintainer. An attacker, with the ability to send a properly crafted URL, can bypass the urlregex check and gain access to the blocked resource. The highest threat from this...

python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS

An uncontrolled resource consumption vulnerability was discovered in python in the class AbstractBasicAuthHandler, due to the kind of regular expression used while handling an authentication request in the httperrorauthreqed method. Client applications that use, directly or indirectly,...

Moderate: pcre2 security and enhancement update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode CVE-2019-20454 For...

RLSA-2020:4539 Moderate: pcre2 security and enhancement update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode CVE-2019-20454 For...

ALSA-2020:4539 Moderate: pcre2 security and enhancement update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode CVE-2019-20454 For...

EulerOS 2.0 SP2 : ruby (EulerOS-SA-2020-2395)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause...

Ruby on Rails: Regular expression denial of service in ActiveRecord's PostgreSQL Money type

Summary Hello team! The regular expressions used in the Money type to convert strings like -$100,000.00 to 100000 have an execution time with a quadratic growth proportional to the length of the string. Causing the denial of service requires very long strings but if the parameter is in a post bod...

Code injection

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS...

CVE-2020-7760 Regular Expression Denial of Service (ReDoS)

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS...

Regular Expression Denial of Service (ReDoS)

Overview ua-parser-js is a lightweight JavaScript-based user-agent string parser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info. Proof of Concept by Miguel de Moura jsconst uaparser =...

Regular Expression Denial Of Service (ReDoS)

trim is vulnerable to regular expression denial of service ReDoS. An attacker can pass a malicious string input str via trim to cause a resource exhaustion and an application crash...

CVE-2020-7755

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values...

CVE-2020-7755

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values...

Input validation

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values...

CVE-2020-7755 Regular Expression Denial of Service (ReDoS)

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values...

CVE-2020-7754 Regular Expression Denial of Service (ReDoS)

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters...

CVE-2020-7753

All versions of package trim are vulnerable to Regular Expression Denial of Service ReDoS via trim...

CVE-2020-7753

CVE-2020-7753: The Connected IBM bulletin confirms that the trim package is vulnerable to Regular Expression Denial of Service (ReDoS) via trim() in all versions. It assigns a high base score (7.5) and references IBM X-Force data; however, the bulletin does not publicly specify a patched version ...