Fallos del tipo CWE-1333

413 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex mal construída que, em casos adversários, força o mecanismo de busca a testar um número exponencial de combinações antes de decidir se há match. Isso consome CPU descontroladamente e pode derrubar a aplicação com um padrão de entrada pequeno e cuidadosamente crafted.

Ejemplo

Um formulário valida email com regex como `(a+)+b`. Se você enviar uma string com muitos 'a's e nenhum 'b' no final, o mecanismo tenta todas as formas possíveis de agrupar aqueles 'a's antes de falhar, gastando segundos ou minutos em uma entrada de 30 caracteres.

Cómo mitigar

Evite quantificadores aninhados (tipo `(x+)+`, `(x*)*`), use âncoras e alternativas específicas, e defina timeouts para execução de regex. Teste com ferramentas como regex101 ou Regex Tester e considere parsing estruturado em vez de regex quando possível.

CVE-2024-28716HIGHAn issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.EPSS 1.4%CVE-2020-1920—A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resoEPSS 1.4%CVE-2022-4891LOWSisimai string.rb to_plain redosEPSS 1.3%CVE-2022-24373MEDIUMRegular Expression Denial of Service (ReDoS)EPSS 1.3%CVE-2022-25918MEDIUMRegular Expression Denial of Service (ReDoS)EPSS 1.3%CVE-2023-2198HIGHAn issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 beforEPSS 1.3%CVE-2023-2132HIGHAn issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 befoEPSS 1.3%CVE-2024-22640HIGHTCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.EPSS 1.3%CVE-2023-2199HIGHAn issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 befoEPSS 1.3%CVE-2022-42124HIGHReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through EPSS 1.3%CVE-2022-37259HIGHA Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.EPSS 1.3%CVE-2021-3777HIGHInefficient Regular Expression Complexity in daaku/nodejs-tmplEPSS 1.3%CVE-2022-2596MEDIUMInefficient Regular Expression Complexity in node-fetch/node-fetchEPSS 1.3%CVE-2023-26112LOWAll versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\EPSS 1.3%CVE-2021-3804HIGHInefficient Regular Expression Complexity in nervjs/taroEPSS 1.3%CVE-2021-3810HIGHInefficient Regular Expression Complexity in cdr/code-serverEPSS 1.3%CVE-2024-10270MEDIUMOrg.keycloak:keycloak-services: keycloak denial of serviceEPSS 1.3%CVE-2023-26103MEDIUMVersions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket functiEPSS 1.2%CVE-2021-3794HIGHInefficient Regular Expression Complexity in vuelidate/vuelidateEPSS 1.2%CVE-2021-3820MEDIUMInefficient Regular Expression Complexity in pksunkara/inflectEPSS 1.2%