GHSA-c2qf-rxjj-qqgw
semver vulnerable to Regular Expression Denial of Service
At a glance
- Published
- Updated
- CVE
- CVE-2022-25883
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Affected packages
| Package | Versions |
|---|---|
| npm · semver | introduced 7.0.0, fixed 7.5.2 |
| npm · semver | introduced 6.0.0, fixed 6.3.1 |
| npm · semver | introduced 2.0.0-alpha, fixed 5.7.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-25883 ADVISORY
- https://github.com/npm/node-semver/pull/564 WEB
- https://github.com/npm/node-semver/pull/585 WEB
- https://github.com/npm/node-semver/pull/593 WEB
- https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0 WEB
- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441 WEB
- https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c WEB
- https://github.com/npm/node-semver PACKAGE
- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104 WEB
- https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104 WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js#L138 WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js#L160 WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L138 WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L160 WEB
- https://security.netapp.com/advisory/ntap-20241025-0004 WEB
- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |