GHSA-4gw3-8f77-f72c

Source

https://github.com/advisories/GHSA-4gw3-8f77-f72c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-4gw3-8f77-f72c/GHSA-4gw3-8f77-f72c.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4gw3-8f77-f72c

Aliases

CVE-2020-7760
SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450
SNYK-JAVA-ORGWEBJARS-1024449
SNYK-JAVA-ORGWEBJARSBOWER-1024445
SNYK-JAVA-ORGWEBJARSBOWERGITHUBCODEMIRROR-1024448
SNYK-JAVA-ORGWEBJARSBOWERGITHUBCOMPONENTS-1024446
SNYK-JAVA-ORGWEBJARSNPM-1024447
SNYK-JS-CODEMIRROR-1016937

Published

2021-05-10T18:46:27Z

Modified

2023-11-02T02:57:19.623573Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Regular expression denial of service in codemirror

Details

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/.?/)

Database specific

{
    "nvd_published_at": "2020-10-30T11:15:00Z",
    "github_reviewed_at": "2021-04-21T17:29:09Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-400"
    ]
}

References

Affected packages

npm / codemirror

Package

Name: codemirror; View open source insights on deps.dev
Purl: pkg:npm/codemirror

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.58.2