CVE-2021-23362 — Regex Denial of Service in Hosted-git-info

CWE-1333 — Regex Denial of ServiceCWE-400 — Uncontrolled Resource Consumption8 documents7 sources
Severity
5.3MEDIUMNVD
EPSS
0.6%
top 31.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Npmjs Hosted-git-infoSiemens Sinec Infrastructure Network Services
Timeline
PublishedMar 23
Latest updateSep 2

Description

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5npmjs/hosted-git-infounspecified — 3.0.8
▶NVDnpmjs/hosted-git-info2.0.0 — 2.8.9+1
▶npmnpmjs/hosted-git-info3.0.0 — 3.0.8+1

Patches

Patch: cert-portal.siemens.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Regular Expression Denial of Service in hosted-git-info↗2021-05-06
▶
GHSA
Regular Expression Denial of Service in hosted-git-info↗2021-05-06
▶
CVEList
Regular Expression Denial of Service (ReDoS)↗2021-03-23
▶
OSV
CVE-2021-23362: The package hosted-git-info before 3↗2021-03-23
▶

📋Vendor Advisories

3
Ubuntu
hosted-git-info vulnerability↗2022-09-02
▶
Red Hat
nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()↗2021-03-23
▶
Debian
CVE-2021-23362: node-hosted-git-info - The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression De...↗2021
▶
CVE-2021-23362 — Regex Denial of Service | cvebase