Fix CVE–2021–23343

[debricked]

CVE–2021–23343

Vulnerability details

Description

NVD

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

GitHub

Regular Expression Denial of Service in path-parse

Affected versions of npm package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

CVSS details - 7.5

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity	None
Availability	High

References

    Regular Expression Denial of Service in path-parse · CVE-2021-23343 · GitHub Advisory Database · GitHub
    NVD - CVE-2021-23343
    ReDoS in path-parse · Issue #8 · jbgutierrez/path-parse · GitHub
    MLIST
    fixed regexes to avoid ReDoS attacks by jeffrey-pinyan-ithreat · Pull Request #10 · jbgutierrez/path-parse · GitHub
    Merge pull request #10 from jeffrey-pinyan-ithreat/master · jbgutierrez/path-parse@eca63a7 · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE