CVE-2022-25927

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

References

Affected packages

Debian:11 / node-ua-parser-js

Package

Name: node-ua-parser-js
Purl: pkg:deb/debian/node-ua-parser-js?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.7.24+ds-1

0.7.24+ds-2

0.7.31+ds+~0.7.36-1

0.8.1+ds+~0.7.36-1

0.8.1+ds+~0.7.36-2

0.8.1+ds+~0.7.36-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / node-ua-parser-js

Package

Name: node-ua-parser-js
Purl: pkg:deb/debian/node-ua-parser-js?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.8.1+ds+~0.7.36-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / node-ua-parser-js

Package

Name: node-ua-parser-js
Purl: pkg:deb/debian/node-ua-parser-js?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.8.1+ds+~0.7.36-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/faisalman/ua-parser-js

Affected ranges

Type: GIT
Repo: https://github.com/faisalman/ua-parser-js
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

a6140a17dd0300a35cfc9cff999545f267889411

Fixed

a6140a17dd0300a35cfc9cff999545f267889411

Affected versions

0.*

0.7.1

0.7.10

0.7.11

0.7.12

0.7.13

0.7.14

0.7.15

0.7.16

0.7.17

0.7.18

0.7.19

0.7.2

0.7.20

0.7.21

0.7.22

0.7.23

0.7.24

0.7.25

0.7.26

0.7.27

0.7.28

0.7.3

0.7.30

0.7.31

0.7.32

0.7.7

0.7.9

0.8.1

1.*

1.0.1

v0.*

v0.1

v0.1.2

v0.2.0

v0.2.1

v0.3.0

v0.3.2

v0.3.4

v0.4.0

v0.4.15

v0.4.3

v0.4.6

v0.4.8

v0.5.11

v0.5.15

v0.5.25

v0.6.0

v0.6.2

v0.7.1