CVE-2021-29060
MEDIUM5.3EPSS 0.40%Regular Expression Denial of Service (ReDOS)
描述
In the npm package `color-string`, there is a ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for linearly increasing input lengths for `hwb()` color strings. Strings reaching more than 5000 characters would see several milliseconds of processing time; strings reaching more than 50,000 characters began seeing 1500ms (1.5s) of processing time. The cause was due to a the regular expression that parses hwb() strings - specifically, the hue value - where the integer portion of the hue value used a 0-or-more quantifier shortly thereafter followed by a 1-or-more quantifier. This caused excessive backtracking and a cartesian scan, resulting in exponential time complexity given a linear increase in input length.
受影響套件(2)
- Debian/node-color-stringfrom 0, < 1.5.4-2
- npm/color-stringfrom 0, < 1.5.5
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
參考連結(7)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-29060
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-29060
- WEBhttps://github.com/Qix-/color-string/commit/0789e21284c33d89ebc4ab4ca6f759b9375ac9d3
- WEBhttps://github.com/Qix-/color-string/releases/tag/1.5.5
- WEBhttps://github.com/yetingli/PoCs/blob/main/CVE-2021-29060/Color-String.md
- WEBhttps://github.com/yetingli/SaveResults/blob/main/js/color-string.js
- WEBhttps://www.npmjs.com/package/color-string