CVE-2021-23362

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-23362
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch Third Party Advisory
https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7 Patch Third Party Advisory
https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01 Patch Third Party Advisory
https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3 Patch Third Party Advisory
https://github.com/npm/hosted-git-info/commits/v2 Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356 Exploit Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 Exploit Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:npmjs:hosted-git-info:*:*:*:*:*:*:*:*
cpe:2.3:a:npmjs:hosted-git-info:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*
History

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE NVD-CWE-Other CWE-1333

08 Apr 2022, 13:31

Type Values Removed Values Added
CPE cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*
First Time Siemens sinec Infrastructure Network Services
Siemens
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - Patch, Third Party Advisory

10 Mar 2022, 17:41

Type Values Removed Values Added
References
  • (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf -

08 Jun 2021, 19:30

Type Values Removed Values Added
References (MISC) https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7 - (MISC) https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7 - Patch, Third Party Advisory
References (MISC) https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01 - (MISC) https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01 - Patch, Third Party Advisory
References (MISC) https://github.com/npm/hosted-git-info/commits/v2 - (MISC) https://github.com/npm/hosted-git-info/commits/v2 - Patch, Third Party Advisory

07 Jun 2021, 21:15

Type Values Removed Values Added
References
  • (MISC) https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7 -
  • (MISC) https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01 -
  • (MISC) https://github.com/npm/hosted-git-info/commits/v2 -

05 Apr 2021, 16:15

Type Values Removed Values Added
Summary The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via shortcutMatch in fromUrl(). The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

25 Mar 2021, 19:11

Type Values Removed Values Added
References (MISC) https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 - (MISC) https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 - Exploit, Patch, Third Party Advisory
References (MISC) https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356 - (MISC) https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356 - Exploit, Patch, Third Party Advisory
References (MISC) https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3 - (MISC) https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3 - Patch, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 5.3
CPE cpe:2.3:a:npmjs:hosted-git-info:*:*:*:*:*:*:*:*
CWE NVD-CWE-Other

23 Mar 2021, 17:28

Type Values Removed Values Added
New CVE
Information

Published : 2021-03-23 17:15

Updated : 2023-12-10 13:41

NVD link : CVE-2021-23362

Mitre link : CVE-2021-23362

CVE.ORG link : CVE-2021-23362

JSON object : View

Products Affected

siemens

  • sinec_infrastructure_network_services

npmjs

  • hosted-git-info
CWE
CWE-1333