Lucene search
Ubuntu.comUB:CVE-2022-25883HistoryJun 21, 2023 - 12:00 a.m.
CVE-2022-25883
2023-06-2100:00:00
ubuntu.com
ubuntu.com
33
semver
package
redos
regular expression denial of service
unix
vulnerability
new range
untrusted user data
0.001 Low
EPSS
Percentile
41.9%
Versions of the package semver before 7.5.2 are vulnerable to Regular
Expression Denial of Service (ReDoS) via the function new Range, when
untrusted user data is provided as a range.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | node-semver | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | node-semver | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | node-semver | < any | UNKNOWN |
| ubuntu | 23.10 | noarch | node-semver | < any | UNKNOWN |
| ubuntu | 24.04 | noarch | node-semver | < any | UNKNOWN |
| ubuntu | 14.04 | noarch | node-semver | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | node-semver | < any | UNKNOWN |
References
github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
github.com/npm/node-semver/blob/main/internal/re.js%23L138
github.com/npm/node-semver/blob/main/internal/re.js%23L160
github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
github.com/npm/node-semver/pull/564
launchpad.net/bugs/cve/CVE-2022-25883
nvd.nist.gov/vuln/detail/CVE-2022-25883
security-tracker.debian.org/tracker/CVE-2022-25883
security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
www.cve.org/CVERecord?id=CVE-2022-25883
Related
nessus
nessus
RHEL 6 : nodejs-semver (Unpatched Vulnerability)
2024-05-11 00:00:00
RHEL 7 : nodejs-semver (Unpatched Vulnerability)
2024-05-11 00:00:00
cvelist
cvelist
CVE-2022-25883
2023-06-21 05:00:03
ibm
ibm
debiancve
debiancve
CVE-2022-25883
2023-06-21 05:15:00
cbl_mariner
cbl_mariner
CVE-2022-25883 affecting package nodejs for versions less than 16.20.1-2
2023-08-03 02:51:21
CVE-2022-25883 affecting package nodejs18 for versions less than 18.16.0-3
2023-08-03 02:51:21
osv
osv
semver vulnerable to Regular Expression Denial of Service
2023-06-21 06:30:28
CVE-2022-25883
2023-06-21 05:15:09
Stylelint has vulnerability in semver dependency
2023-07-07 20:32:55
cve
cve
CVE-2022-25883
2023-06-21 05:15:00
github
github
semver vulnerable to Regular Expression Denial of Service
2023-06-21 06:30:28
Stylelint has vulnerability in semver dependency
2023-07-07 20:32:55
cgr
cgr
CVE-2022-25883 vulnerabilities
2024-05-19 03:07:16
prion
prion
Code injection
2023-06-21 05:15:00
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2023-06-29 11:12:31
redhatcve
redhatcve
CVE-2022-25883
2023-07-12 14:35:38
redhat
redhat
oraclelinux
oraclelinux
nodejs:18 security, bug fix, and enhancement update
2023-09-28 00:00:00
nodejs:16 security, bug fix, and enhancement update
2023-09-28 00:00:00
nodejs:18 security, bug fix, and enhancement update
2023-10-05 00:00:00
almalinux
almalinux
Important: nodejs:18 security, bug fix, and enhancement update
2023-09-26 00:00:00
Important: nodejs:18 security, bug fix, and enhancement update
2023-09-26 00:00:00
Important: nodejs:16 security, bug fix, and enhancement update
2023-09-26 00:00:00
rocky
rocky
nodejs:18 security, bug fix, and enhancement update
2023-10-05 21:35:58