CVE-2024-52798

描述

### Impact The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of `path-to-regexp`, originally reported in CVE-2024-45296 ### Patches Upgrade to 0.1.12. ### Workarounds Avoid using two parameters within a single path segment, when the separator is not `.` (e.g. no `/:a-:b`). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking. ### References - https://github.com/advisories/GHSA-9wv6-86v2-598j - https://blakeembrey.com/posts/2024-09-web-redos/

如何修補 CVE-2024-52798

要修補 CVE-2024-52798,請將受影響套件升級到下列已修補版本。

• —升級至 0.1.12 或更新版本

CVE-2024-52798 正在被利用嗎?

低 — EPSS 為 0.8%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.1.12

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-52798
• PATCHgithub.com/pillarjs/path-to-regexp
• WEBblakeembrey.com/posts/2024-09-web-redos
• WEBgithub.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4