Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Regular Expression Denial of Service (ReDoS) #70

Open
larrycameron80 opened this issue Sep 17, 2019 · 0 comments
Open

Regular Expression Denial of Service (ReDoS) #70

larrycameron80 opened this issue Sep 17, 2019 · 0 comments

Comments

@larrycameron80
Copy link

Regular Expression Denial of Service (ReDoS)
Vulnerable module: debug
Introduced through: [email protected], [email protected] and others
Detailed paths
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › [email protected][email protected]
Remediation: Upgrade to [email protected].
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › [email protected][email protected]
Remediation: Upgrade to [email protected].
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › [email protected][email protected]
Remediation: Upgrade to [email protected].
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › [email protected][email protected][email protected]
Remediation: Upgrade to [email protected].
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › [email protected][email protected][email protected]
Remediation: Upgrade to [email protected].
Introduced through: etherchain-light@gobitfly/etherchain-light#0163743bbd61c33ad71cb238ca4ea900fa922710 › [email protected][email protected][email protected][email protected]
Remediation: Upgrade to [email protected].
Overview
debug is a JavaScript debugging utility modelled after Node.js core's debugging technique..

debug uses printf-style formatting. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks via the the %o formatter (Pretty-print an Object all on a single line). It used a regular expression (/\s*\n\s*/g) in order to strip whitespaces and replace newlines with spaces, in order to join the data into a single line. This can cause a very low impact of about 2 seconds matching time for data 50k characters long.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant