semver-regex 安全漏洞

npm semver-regex is a regular expression used to match semver versions. semver-regex versions prior to 3.1.4 and versions 4.0.0 inclusive through 4.0.2 have a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited to cause a denial of...

CVE-2021-43307

CVE-2021-43307 is a Denial of Service vulnerability in the semver-regex npm package that can be triggered by arbitrary input to the test() method, causing an exponential ReDoS. Public sources (CNVD-2022-76985) indicate DoS affects semver-regex versions prior to 3.1.4 and 4.0.0–4.0.2; patch versio...

CVE-2021-43307 Exponential ReDoS in semver-regex

An exponential ReDoS Regular Expression Denial of Service can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test method...

PT-2022-11819

Name of the Vulnerable Software and Affected Versions semver-regex affected versions not specified Description An exponential ReDoS Regular Expression Denial of Service can be triggered in the semver-regex npm package when an attacker supplies arbitrary input to the test method. Recommendations A...

CVE-2021-43307

An exponential ReDoS Regular Expression Denial of Service can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test method...

@nice-move/cli (>=0.5.13, <=0.5.21), @nice-move/init (>=0.1.12, <=0.2.4) +4 more potentially affected by CVE-2021-3795 via semver-regex (>=3.0.0, <=3.1.2)

semver-regex NPM version =3.0.0, =0.5.13, =0.1.12, =2.7.0, =1.2.0, =1.2.3 Source cves: CVE-2021-3795 Source advisory: OSV:GHSA-44C6-4V22-4MHX...

CVE-2021-3795

A flaw was found in the semver-regex library where it could lead to consuming a big amount of resources when executing specific strings. Attackers could take advantage of this by crafting an invalid version causing a disruption or a denial of service DoS...

Regular Expression Denial Of Service (ReDoS)

semver-regex is vulnerable to regular expression denial of service. An attacker is able to crash the application by submitting a malicious string to the function semverRegex...

CVE-2021-3795

semver-regex is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3795

semver-regex is vulnerable to Inefficient Regular Expression Complexity...

Design/Logic Flaw

semver-regex is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3795

CVE-2021-3795 affects the semver-regex package with Inefficient Regular Expression Complexity, leading to potential DoS. Affected: Carbon project packages (see Affected Products list). Remediation: upgrade to the fixed Carbon release set (e.g., prettier-config-carbon 0.12.0, @carbon/cli 11.31.0, ...

CVE-2021-3795 Inefficient Regular Expression Complexity in sindresorhus/semver-regex

semver-regex is vulnerable to Inefficient Regular Expression Complexity...

Inefficient Regular Expression Complexity in sindresorhus/semver-regex

✍️ Description It allows cause a denial of service when formatting crafted invalid semver versions. 🕵️‍♂️ Proof of Concept // PoC.mjs import semverRegex from 'semver-regex'; forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = '0.0.0-0' + '.-------'.repeati1 + '@';...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data loaded from potentially untrusted...

USN-4776-1: semver vulnerability

It was discovered that semver incorrectly handled certain inputs. A remote attacker could possibly use this issue to cause a denial of service...

CVE-2021-21303

Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data loaded from potentially untrusted...

CVE-2021-21303

Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data loaded from potentially untrusted...

Regular Expression Denial Of Service (ReDoS)

semver-regex is vulnerable to regular expression denial of service. An attacker is able to crash the application by submitting a malicious string as a version number...

fabric8-analytics-lsp-server (0.3.0), graphql-validated-types (>=2.7.0, <=2.11.0) +1 more potentially affected by unknown CVE via semver-regex (>=3.0.0, <=3.1.1)

semver-regex NPM version =3.0.0, =2.7.0, =1.2.0, =1.2.3 Source cves: unknown CVE Source advisory: SNYK:JS-SEMVERREGEX-1047770...