Denial of Service Vulnerability in uap-core Package
Summary
DEBIAN-CVE-2020-5243: uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Affects uap-core versions < 1:0.8.0-1. Fixed in 1:0.8.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uap-core package is a library used for parsing User-Agent strings in web applications. It is designed to help developers identify the type of device, browser, and operating system used by clients accessing their services. This package is widely utilized in various web frameworks and applications to enhance user experience by tailoring responses based on client capabilities. However, prior to version 0.7.3, uap-core is susceptible to a denial of service (DoS) attack due to its handling of crafted User-Agent strings.
Vulnerability Detail
The vulnerability in uap-core arises from its use of regular expressions that contain overlapping capture groups, which can lead to regular expression denial of service (REDoS). This flaw allows remote attackers to craft maliciously long User-Agent strings that can overwhelm the server, resulting in degraded performance or complete service unavailability. The issue was identified in versions prior to 0.7.3, and it poses a significant risk to any application relying on this package for User-Agent parsing.
How To Fix
Minimum fixed version
1:0.8.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade uap-coreTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to restrict the length and format of User-Agent strings accepted by your application. This can help mitigate the risk of DoS attacks while you work on updating the package.
Conclusion
The uap-core package has a critical vulnerability that can lead to denial of service attacks through crafted User-Agent strings. It is crucial to update to the patched version 0.8.0-1 or later to protect your application. Implementing input validation can serve as a temporary measure while you work on the update.
See every vulnerability recorded for uap-core →
FAQ
The vulnerability is a denial of service (DoS) issue caused by overlapping capture groups in regular expressions, allowing attackers to overload the server with crafted User-Agent strings.
If your application uses uap-core version prior to 0.7.3, it is vulnerable. You can check your package version using the command 'apt-cache policy uap-core'.
The vulnerability can lead to server overload, resulting in degraded performance or complete service outages, affecting user experience and application reliability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file. You can check your application's vulnerability status without any signup at the Vulert playground.
If an immediate update is not possible, implement input validation to restrict User-Agent strings and reduce the risk of DoS attacks until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for uap-core.
