CVE-2018-1107: Regular expression denial of service (ReDoS) in is-my-json-valid
Summary
CVE-2018-1107: Regular expression deinal of service (ReDoS) in is-my-json-valid. Affects is-my-json-valid across 2 version ranges.
< 1.4.1
>= 2.0.0, < 2.17.2
Fixed in 1.4.1 or 2.17.2, depending on the release line you run. How to fix ↓
Also tracked for
- is-my-json-valid · ghsa
The same CVE-2018-1107 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
is-my-json-valid is a JavaScript library used for validating JSON data against a JSON schema. It provides a simple and efficient way to ensure that JSON data conforms to a specified structure. However, a vulnerability has been discovered in versions 0.0.0 to 1.4.1 and 2.0.0 to 2.17.2 of the library, which can lead to a regular expression denial of service (ReDoS) attack. This vulnerability affects applications that use is-my-json-valid to validate JSON fields defined to have an email format.
Vulnerability Detail
The vulnerability arises from the use of an inefficient regular expression in is-my-json-valid for validating email fields in JSON data. An attacker can exploit this vulnerability by crafting a specially crafted JSON file that triggers excessive CPU usage during validation. This can result in a denial of service condition, where the application becomes unresponsive or slows down significantly. The impact of this vulnerability can be severe, as it can be exploited remotely without authentication.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.4.11.4.1npm install is-my-json-valid@1.4.1 -
>= 2.0.0, < 2.17.22.17.2npm install is-my-json-valid@2.17.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to validate email fields using a different library or a custom validation function that does not suffer from the same regular expression inefficiency. This can help mitigate the risk of a ReDoS attack until the library can be updated.
Conclusion
The is-my-json-valid library is vulnerable to a regular expression denial of service (ReDoS) attack when validating email fields in JSON data. This can lead to a denial of service condition in affected applications. It is crucial to upgrade to the latest version of is-my-json-valid or implement a workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for is-my-json-valid →
FAQ
is-my-json-valid is a JavaScript library used for validating JSON data against a JSON schema. It provides a simple and efficient way to ensure that JSON data conforms to a specified structure.
The vulnerability arises from the use of an inefficient regular expression in is-my-json-valid for validating email fields in JSON data. This regular expression can be exploited to cause excessive CPU usage during validation, leading to a denial of service condition.
The impact of this vulnerability can be severe, as it allows remote attackers to cause a denial of service condition in applications that use is-my-json-valid for email field validation. This can result in application unresponsiveness or significant slowdown.
To fix this vulnerability, it is recommended to upgrade to the latest version of is-my-json-valid (version 2.17.2 or later). This version includes a fix for the inefficient regular expression. Alternatively, you can use a different library or custom validation function for email field validation.
Yes, if upgrading to the latest version is not immediately feasible, you can use a different library or custom validation function for email field validation that does not suffer from the same regular expression inefficiency. This can help mitigate the risk of a ReDoS attack until the library can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for is-my-json-valid.
