CVE-2021-23362: Regular Expression Denial of Service (ReDoS)
A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression (regexp) function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process, potentially resulting in a denial of service.
Other sources
Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the fromUrl function in index.js. By sending a specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via shortcutMatch in fromUrl().
References:
https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356 https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
Fixed releases : hosted-git-info 3.0.8, hosted-git-info 2.8.9
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-23362.
What is the severity of CVE-2021-23362?
The severity of CVE-2021-23362 is high with a score of 7.5.
Which software versions are affected by CVE-2021-23362?
The affected software versions are hosted-git-info before 3.0.8 and 2.0.0 to 2.8.9.
How can an attacker exploit CVE-2021-23362?
An attacker can exploit CVE-2021-23362 by crafting a regular expression that takes an ever increasing amount of time to process, leading to a denial of service.
Where can I find more information about CVE-2021-23362?
You can find more information about CVE-2021-23362 at the following references: [link1](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf), [link2](https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7), [link3](https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01).