Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-1929

Good to know:

icon
icon

Date: June 1, 2022

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

Language: TYPE_SCRIPT

Severity Score

Related Resources (6)

https://github.com/davewasmer/devcert
https://github.com/davewasmer/devcert/commit/b0763215f6683271d296fda98f7ef7bcd4a55977
https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352
https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352/
https://nvd.nist.gov/vuln/detail/CVE-2022-1929
https://www.mend.io/vulnerability-database/CVE-2022-1929

Severity Score

Weakness Type (CWE)

Incorrect Comparison

CWE-697

Inefficient Regular Expression Complexity

CWE-1333

Top Fix

icon

Upgrade Version

Upgrade to version devcert - 1.2.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us