CVE-2018-20164
Summary
| CVE | CVE-2018-20164 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-02-13 14:29:00 UTC |
|---|
| Updated | 2019-10-02 20:15:00 UTC |
|---|
| Description | An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.) |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Performance issue with backtracking caused by some regexes · Issue #332 · ua-parser/uap-core · GitHub |
MISC |
github.com |
|
| 0.6.0 · ua-parser/uap-core@010ccdc · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Advisory X41-2018-009: DoS Vulnerability in UA-Parser | X41 D-SEC GmbH |
MISC |
www.x41-dsec.de |
Exploit, Third Party Advisory |
| Merge pull request #363 from commenthol/safe-regex · ua-parser/uap-core@156f7e1 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981095 Nodejs (npm) Security Update for uap-core (GHSA-fx7m-j728-mjw3)
