Bug 2006336 (CVE-2021-3803) - CVE-2021-3803 nodejs-nth-check: inefficient regular expression complexity
Summary: CVE-2021-3803 nodejs-nth-check: inefficient regular expression complexity
Keywords:
Status: NEW
Alias: CVE-2021-3803
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2006338 2006337 2009020 2009021 2013367 2013368 2013369 2013370 2013371 2013372 2013373 2013374 2015725 2015726 2015727
Blocks: 2006340
TreeView+ depends on / blocked
 
Reported: 2021-09-21 13:58 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-10-25 17:21 UTC (History)
30 users (show)

Fixed In Version: nth-check 2.0.1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in nth-check nodejs library where it could lead to consuming a big amount of resources when executing some checks. Attackers could take advantage of this by crafting an invalid CSS nth-checks causing a disruption or a denial of service (DoS).
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-09-21 13:58:27 UTC 
nth-check is vulnerable to Inefficient Regular Expression Complexity

Reference:
https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0

Upstream patch:
https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726
Comment 1 Guilherme de Almeida Suckevicz 2021-09-21 13:59:15 UTC 
Created nodejs-nth-check tracking bugs for this issue:

Affects: epel-7 [bug 2006338]
Affects: fedora-33 [bug 2006337]
Note You need to log in before you can comment on or make changes to this bug.