CVE-2022-1929

Exponential ReDoS in devcert

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

Affected

devcert

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 JFROG

5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

0.63% chance of exploitation in the next 30 days, 49th percentile

Published

2022-06-01

Updated

2024-09-16

Proof-of-concept exploits (1)

• https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352/

Security advisories

• https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352
• advisories/GHSA-fp36-299x-pwmw

References

• CVE Record
• NVD entry