CVE-2021-23354: printf Regular Expression Denial of Service (ReDoS)
Summary
CVE-2021-23354: printf vulnerable to Regular Expression Denial of Service (ReDoS). Affects printf versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The printf package is an npm package that provides string formatting functionality. It allows users to format strings using placeholders and various formatting options. The package is widely used in JavaScript applications for generating formatted output. However, versions of printf before 0.6.1 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The vulnerability in printf is due to a regular expression pattern in the lib/printf.js file. The vulnerable regular expression has cubic worst-case time complexity, making it susceptible to ReDoS attacks. An attacker can exploit this vulnerability by providing a specially crafted input string that triggers the excessive backtracking behavior of the regular expression. This can lead to a denial of service condition, where the application becomes unresponsive or crashes. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
0.6.1
This is the first release that contains the fix.
npm install printf@0.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the printf package to the latest version as soon as possible.
Conclusion
The printf package before version 0.6.1 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This can lead to a denial of service condition in applications that use the package. It is crucial for developers to update to the latest version of the package (0.6.1 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for printf →
FAQ
This vulnerability can lead to a denial of service condition in applications that use the vulnerable printf package. An attacker can exploit this vulnerability to make the application unresponsive or crash.
No, only versions of printf before 0.6.1 are affected. Developers should update to version 0.6.1 or later to mitigate the vulnerability.
There is no known public exploit for this vulnerability at the time of this report. However, it is advisable to update the package to the latest version to prevent any potential attacks.
Yes, this vulnerability can be exploited remotely. An attacker can send a specially crafted input string to the application, triggering the ReDoS vulnerability in the printf package.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is recommended to update the package to the latest version to mitigate any potential risks.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
