CVE-2021-23362: Regular Expression Denial of Service (ReDoS)
A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression (regexp) function, `shortcutMatch` or `fromUrl`, then an attacker could craft a regexp which takes an ever increasing amount of time to process, potentially resulting in a denial of service.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-23362.
What is the severity of CVE-2021-23362?
The severity of CVE-2021-23362 is high with a score of 7.5.
Which software versions are affected by CVE-2021-23362?
The affected software versions are hosted-git-info before 3.0.8 and 2.0.0 to 2.8.9.
How can an attacker exploit CVE-2021-23362?
An attacker can exploit CVE-2021-23362 by crafting a regular expression that takes an ever increasing amount of time to process, leading to a denial of service.
Where can I find more information about CVE-2021-23362?
You can find more information about CVE-2021-23362 at the following references: [link1](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf), [link2](https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7), [link3](https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01).