Regular Expression Denial of Service in uap-core: CVE-2018-20164
Summary
CVE-2018-20164: An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. Affects uap-core across 3 version ranges.
< 010ccdc7303546cd22b9da687c29f4a996990014
< 156f7e12b215bddbaf3df4514c399d683e6cdadc
< 20190213-1
Fixed in 20190213-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
uap-core is a library used for parsing User-Agent strings in web applications. It helps in identifying the device, operating system, and browser type of the client making the request. This functionality is crucial for analytics, content adaptation, and user experience enhancement. However, the library is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability, which can be exploited by attackers to overload the server.
Vulnerability Detail
CVE-2018-20164 is a vulnerability found in the regex.yaml file of the uap-core library prior to version 0.6.0. The vulnerability allows remote attackers to exploit the Regular Expression used for parsing User-Agent headers. By sending a specially crafted User-Agent string containing a long digit sequence, an attacker can cause excessive backtracking in the regex engine, leading to significant delays in request processing. This can result in a Denial of Service condition, where legitimate users are unable to access the service due to resource exhaustion.
How To Fix
Minimum fixed version
20190213-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade uap-coreTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing rate limiting on incoming requests to mitigate the impact of potential exploitation. Additionally, you can sanitize User-Agent strings to reject overly long or suspicious inputs.
Conclusion
CVE-2018-20164 is a significant vulnerability in the uap-core library that can lead to Denial of Service through Regular Expression exploitation. It is crucial to update to the latest version to safeguard against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for uap-core →
FAQ
CVE-2018-20164 is a vulnerability in the uap-core library that allows attackers to exploit Regular Expressions used for parsing User-Agent headers, leading to Denial of Service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to server overload, causing legitimate users to experience delays or be unable to access the service.
The CVSS score for CVE-2018-20164 is 5.3, indicating a moderate severity level.
Yes, implementing rate limiting and sanitizing User-Agent strings can help mitigate the risk until an update is applied.
Related vulnerabilities
Recent vulnerabilities recorded for uap-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
