CVE-2021-29060: High severity color-string vulnerability
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.
Other sources
Color-String is vulnerable to a denial of service, caused by an error when the application is provided and checks a crafted invalid HWB string. By sending a specially crafted string, a remote attacker could exploit this vulnerability to cause a regular expression denial of service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-29060?
CVE-2021-29060 is a Regular Expression Denial of Service (ReDOS) vulnerability discovered in Color-String.
What is the severity of CVE-2021-29060?
The severity of CVE-2021-29060 is high with a CVSS score of 7.5.
How does CVE-2021-29060 affect Color-String?
CVE-2021-29060 affects Color-String by causing a denial of service when a crafted invalid HWB string is provided and checked by the application.
How can a remote attacker exploit CVE-2021-29060?
A remote attacker can exploit CVE-2021-29060 by sending a specially crafted string to cause a regular expression denial of service.
Is there a fix available for CVE-2021-29060?
Yes, a fix for CVE-2021-29060 is available. It is recommended to update Color-String to a version beyond 1.5.5.