GHSA-pfrm-4rjw-g9q5

Source

https://github.com/advisories/GHSA-pfrm-4rjw-g9q5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-pfrm-4rjw-g9q5/GHSA-pfrm-4rjw-g9q5.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-pfrm-4rjw-g9q5

Aliases

CVE-2021-4299

Published

2023-01-02T09:31:57Z

Modified

2023-11-01T04:56:40.438857Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

string-kit Inefficient Regular Expression Complexity vulnerability

Details

A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 0.12.8 can address this issue. The name of the patch is 9cac4c298ee92c1695b0695951f1488884a7ca73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217180.

Database specific

{
    "nvd_published_at": "2023-01-02T08:15:00Z",
    "github_reviewed_at": "2023-01-04T14:27:35Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1333"
    ]
}

References

Affected packages

npm / string-kit

Package

Name: string-kit; View open source insights on deps.dev
Purl: pkg:npm/string-kit

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.12.8