ReDoS vulnerability in ua-parser/uap-php
Summary
GHSA-78hm-5hjw-58mh: ua-parser/uap-php ReDoS vulnerability. Affects ua-parser/uap-php versions < 3.8.0. Fixed in 3.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ua-parser/uap-php is a library that provides user-agent string parsing functionality. It is commonly used to extract information about the user's browser, operating system, and device from the user-agent string. The library is available on Packagist and can be installed via Composer. However, versions prior to 3.8.0 are vulnerable to a ReDoS (Regular Expression Denial of Service) attack.
Vulnerability Detail
The vulnerability in ua-parser/uap-php is due to a regex expression that can be exploited to cause a ReDoS attack. ReDoS attacks occur when a malicious user supplies a specially crafted input that causes the regular expression matching to take an excessive amount of time, leading to a denial of service condition. This can impact the availability and performance of the application using the library. The vulnerability has a moderate severity rating and has been reviewed by GitHub.
How To Fix
Minimum fixed version
3.8.0
This is the first release that contains the fix.
composer require ua-parser/uap-php:3.8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
ua-parser/uap-php versions prior to 3.8.0 are vulnerable to a ReDoS attack. It is recommended to update to version 3.8.0 or later to fix the vulnerability. Regularly updating dependencies and staying informed about security vulnerabilities is crucial to ensure the security and stability of your application.
See every vulnerability recorded for ua-parser/uap-php →
FAQ
ua-parser/uap-php is a library that provides user-agent string parsing functionality. It is commonly used to extract information about the user's browser, operating system, and device from the user-agent string.
A ReDoS (Regular Expression Denial of Service) vulnerability occurs when a regular expression matching operation takes an excessive amount of time, leading to a denial of service condition. It can be exploited by supplying a specially crafted input that triggers the excessive matching time.
The vulnerability can impact the availability and performance of the application using ua-parser/uap-php. A malicious user can exploit the vulnerability to cause a denial of service condition, potentially affecting the functionality of the application.
To fix the vulnerability, it is recommended to update ua-parser/uap-php to version 3.8.0 or later. This version includes a fix for the ReDoS vulnerability. You can update the library by running the following command in your project's root directory:
composer update ua-parser/uap-php
You can find more information about this vulnerability, including the source and details, on the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-78hm-5hjw-58mh/GHSA-78hm-5hjw-58mh.json
