CVE-2021-43308

描述

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function

如何修補 CVE-2021-43308

要修補 CVE-2021-43308,請將受影響套件升級到下列已修補版本。

• npm/markdown-link-extractor—升級至 3.0.2 或更新版本

CVE-2021-43308 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 3.0.2

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-43308
• PATCHgithub.com/tcort/markdown-link-extractor
• WEBresearch.jfrog.com/vulnerabilities/markdown-link-extractor-redos-xray-211350