Lucene search

Veracode Vulnerability DatabaseVERACODE:5173

HistorySep 26, 2017 - 9:49 a.m.

Regular Expression Denial Of Service (ReDoS)

2017-09-2609:49:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

mime is vulnerable to regular expression denial of service (ReDoS) attacks. The library does not restrict the type of characters that it takes in, causing the application to take a long time to process. A malicious user can use this behaviour to cause a ReDoS.

CPENameOperatorVersion
mimeeq1.0.0
mimele2.0.2
mimele1.4.0
mimele2.0.2
mimele1.4.0
mimeeq1.2.11
mimele1.3.4

Name	Operator	Version
mime	eq	1.0.0
mime	le	2.0.2
mime	le	1.4.0
mime	le	2.0.2
mime	le	1.4.0
mime	eq	1.2.11
mime	le	1.3.4

References

github.com/broofa/node-mime/issues/167

nodesecurity.io/advisories/535

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

Related for VERACODE:5173