CVE Feed

    Dashboard / CVE / CVE-2021-23362

    CVE-2021-23362

    The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

    Published:Mar 23, 2021
    Last Modified:Nov 21, 2024
    EPS:Mar 23, 2021
    EPSS Score:0.00554
    CVSS Score:5.3

    Affected Products

    Vendor
    Npmjs
    Product
    Hosted-git-info
    Vendor
    Redhat
    Product
    Acm
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Openshift
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Software Collections
    Vendor
    Siemens
    Product
    Sinec Infrastructure Network Services

    Exploits

    https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355

    References

    https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
    https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
    https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01
    https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
    https://github.com/npm/hosted-git-info/commits/v2
    https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
    https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
    https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
    https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
    https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01
    https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
    https://github.com/npm/hosted-git-info/commits/v2
    https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
    https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High