7.8

CVE-2021-3807

Exploit

Inefficient Regular Expression Complexity in chalk/ansi-regex

ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ansi-regex Project ≫ Ansi-regex SwPlatformnode.js Version >= 4.0.0 < 4.1.1
Ansi-regex Project ≫ Ansi-regex Version3.0.0 SwPlatformnode.js
Ansi-regex Project ≫ Ansi-regex Version5.0.0 SwPlatformnode.js
Ansi-regex Project ≫ Ansi-regex Version6.0.0 SwPlatformnode.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.3% 0.869
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:N/I:N/A:C
security@huntr.dev 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9
Patch
Third Party Advisory
https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
Patch
Third Party Advisory
Exploit
Issue Tracking
https://security.netapp.com/advisory/ntap-20221014-0002/
Third Party Advisory