-
Notifications
You must be signed in to change notification settings - Fork 3
/
yarn-audit-known-issues
1 lines (1 loc) · 1.97 KB
/
yarn-audit-known-issues
1
{"type":"auditAdvisory","data":{"resolution":{"id":1088674,"path":"@wdio/cli>webdriverio>devtools>ua-parser-js","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"1.0.32","paths":["@wdio/cli>webdriverio>devtools>ua-parser-js"]}],"metadata":null,"vulnerable_versions":">=0.8.0 <1.0.33","module_name":"ua-parser-js","severity":"high","github_advisory_id":"GHSA-fhg7-m89q-25r3","cves":[],"access":"public","patched_versions":">=1.0.33","cvss":{"score":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"updated":"2023-01-24T15:36:34.000Z","recommendation":"Upgrade to version 1.0.33 or later","cwe":["CWE-400","CWE-1333"],"found_by":null,"deleted":null,"id":1088674,"references":"- https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-fhg7-m89q-25r3\n- https://github.com/faisalman/ua-parser-js/commit/a6140a17dd0300a35cfc9cff999545f267889411\n- https://github.com/advisories/GHSA-fhg7-m89q-25r3","created":"2023-01-24T15:36:32.000Z","reported_by":null,"title":"ReDoS Vulnerability in ua-parser-js version ","npm_advisory_id":null,"overview":"### Description:\nA regular expression denial of service (ReDoS) vulnerability has been discovered in `ua-parser-js`.\n\n### Impact:\nThis vulnerability bypass the library's `MAX_LENGTH` input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.\n\n### Affected Versions:\nAll versions of the library prior to version `0.7.33` / `1.0.33`.\n\n### Patches:\nA patch has been released to remove the vulnerable regular expression, update to version `0.7.33` / `1.0.33` or later.\n\n### References:\n[Regular expression Denial of Service - ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n\n### Credits:\nThanks to @Snyk who first reported the issue.","url":"https://github.com/advisories/GHSA-fhg7-m89q-25r3"}}}