Lucene search

[email protected]CVE-2022-1929

HistoryJun 02, 2022 - 2:15 p.m.

CVE-2022-1929

2022-06-0214:15:33

CWE-1333

[email protected]

web.nvd.nist.gov

cve-2022-1929

nvd

exponential redos

regular expression denial of service

devcert npm package

certificatefor method

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

37.0%

JSON

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

Affected configurations

NVD

Node

devcert_projectdevcertRange<1.2.1node.js

CPENameOperatorVersion
devcert_project:devcertdevcert project devcertlt1.2.1

CPE	Name	Operator	Version
devcert_project:devcert	devcert project devcert	lt	1.2.1

CNA Affected

[
  {
    "product": "devcert",
    "vendor": "devcert",
    "versions": [
      {
        "lessThan": "1.2.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]