Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2022-1929

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

VectorNETWORK

PublishedJun 02, 2022, 14:15

Published Byreefs@jfrog.com

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

devcert(npm)01.2.1N/A

References

https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352/

Weakness Type

CWE-1333

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK