CVE-2021-23343: Regular Expression Denial of Service (ReDoS)
A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Other sources
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
References: https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067 https://github.com/jbgutierrez/path-parse/issues/8
— Red Hat
path-parse is vulnerable to a denial of service. By sending a specially-crafted request via splitDeviceRe, splitTailRe, and splitPathRe regular expressions, a remote attacker could exploit this vulnerability to cause a regular expression denial of service (ReDoS).
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
CVE-2021-23343
What is the severity of CVE-2021-23343?
The severity of CVE-2021-23343 is medium with a CVSS score of 5.3.
Which software versions are affected by CVE-2021-23343?
All versions up to and including 1.0.7 of the path-parse package are affected. Additionally, versions 0:14.17.5-1.el7 and 0:12.22.5-1.el7 of rh-nodejs14-nodejs and rh-nodejs12-nodejs respectively are also affected.
How can an attacker exploit CVE-2021-23343?
An attacker can exploit CVE-2021-23343 by sending a specially-crafted request via certain regular expressions, causing a regular expression denial of service (ReDoS).
How can CVE-2021-23343 be fixed?
To fix CVE-2021-23343, it is recommended to update the path-parse package to version 1.0.8 or later. For rh-nodejs14-nodejs and rh-nodejs12-nodejs, update to versions 0:14.17.6-1.el7 and 0:12.22.6-1.el7 respectively.