CVE-2018-20164: uap-core Regular Expression Denial of Service issue
Summary
CVE-2018-20164: uap-core Regular Expression Denial of Service issue. Affects uap-core versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Also tracked for
- uap-core · Debian:11
The same CVE-2018-20164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uap-core package is an npm package that is used for user-agent parsing. It provides a way to extract information from the User-Agent header in HTTP(S) requests. This package is widely used in web applications to determine the type of device or browser making the request. However, a vulnerability has been discovered in the regex.yaml file of the uap-core package, which can lead to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability affects all implementations of the uap-core project.
Vulnerability Detail
The vulnerability in the uap-core package arises from a Regular Expression Denial of Service (ReDoS) issue. An attacker can exploit this vulnerability by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. This triggers a slow-running regular expression pattern matching process, causing the server to become overloaded and unresponsive. The impact of this vulnerability is that an attacker can potentially disrupt the availability of the server by sending a specially crafted request.
How To Fix
Minimum fixed version
0.6.0
This is the first release that contains the fix.
npm install uap-core@0.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the uap-core package to the fixed version to mitigate the risk.
Conclusion
The uap-core package is vulnerable to a Regular Expression Denial of Service (ReDoS) issue, which can be exploited by sending a specially crafted User-Agent header. To mitigate this vulnerability, it is crucial to update the uap-core package to version 0.6.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for uap-core →
FAQ
The uap-core package is an npm package used for user-agent parsing. It helps extract information from the User-Agent header in HTTP(S) requests.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack where an attacker exploits a vulnerability in a regular expression pattern to cause the matching process to take an excessive amount of time, leading to resource exhaustion and system unresponsiveness.
An attacker can exploit this vulnerability by sending an HTTP(S) request with a specially crafted User-Agent header containing a long digit string. This triggers the slow-running regular expression pattern matching process, causing the server to become overloaded and unresponsive.
The impact of this vulnerability is that an attacker can potentially disrupt the availability of the server by sending a specially crafted request, leading to a denial of service.
Yes, the vulnerability can be fixed by updating the uap-core package to version 0.6.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for uap-core.
