CVE-2023-39663: MathJax Regular expression Denial of Service (ReDoS)
Summary
CVE-2023-39663: MathJax Regular expression Denial of Service (ReDoS). Affects mathjax versions < 2.7.9. No fix is published. How to fix ↓
Also tracked for
- mathjax · Debian:11
The same CVE-2023-39663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MathJax is an open-source JavaScript library that allows the rendering of mathematical equations on web pages. It provides a comprehensive set of tools for displaying math equations in various formats, including LaTeX, MathML, and AsciiMath. MathJax is widely used by websites and applications that require mathematical notation and equations to be displayed. However, versions up to v2.7.9 of MathJax have been found to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern.
Vulnerability Detail
The Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js can be exploited by an attacker to cause a denial of service (DoS) condition. By sending specially crafted input, an attacker can trigger excessive backtracking in the regular expressions used by MathJax, leading to a significant increase in CPU usage and potentially causing the application to become unresponsive. Although the vendor disputes the risk, it is important to note that these regular expressions are not applied to user input.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As the regular expressions in MathJax are not applied to user input, there is no immediate workaround required for this vulnerability.
Conclusion
MathJax versions up to v2.7.9 are affected by Regular expression Denial of Service (ReDoS) vulnerabilities. While the vendor disputes the risk, it is recommended to update MathJax to the latest version to ensure protection against potential DoS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mathjax →
FAQ
MathJax is an open-source JavaScript library used for rendering mathematical equations on web pages.
A Regular expression Denial of Service (ReDoS) vulnerability occurs when a regular expression pattern can be exploited to cause excessive backtracking, leading to a denial of service condition.
These vulnerabilities can potentially cause a denial of service (DoS) condition, resulting in the application becoming unresponsive.
The vendor disputes the risk as the regular expressions in MathJax are not applied to user input.
To fix the vulnerability, update MathJax to a version beyond v2.7.9.
References
Related vulnerabilities
Recent vulnerabilities recorded for mathjax.
