CVE-2021-27290: High severity ibm engineering requirements quality assistant vulnerability
A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service (ReDoS). This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability.
Other sources
Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Reference:
https://doyensec.com/resources/DoyensecAdvisoryssriredos.pdf
— Red Hat
Node.js ssri module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw by the SRIs. By sending a specially-crafted regex string, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
npm ssri 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-27290?
CVE-2021-27290 is a vulnerability in the ssri package that allows a denial of service attack by processing malicious strings that take a long time to process.
What software is affected by CVE-2021-27290?
The ssri package versions 5.2.2-6.0.1 and 7.0.0-8.0.0 are affected by CVE-2021-27290.
What is the severity of CVE-2021-27290?
The severity of CVE-2021-27290 is high, with a severity score of 7.5.
How can I fix CVE-2021-27290?
To fix CVE-2021-27290, upgrade to ssri version 8.0.1 if using npm or the corresponding version provided by Red Hat if using their package.
Where can I find more information about CVE-2021-27290?
You can find more information about CVE-2021-27290 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-27290), [GitHub](https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2), [Doyensec Advisory](https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf).