GitHub Advisoryadvisory · Maven

GHSA-42j4-733x-5vcf Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7

HIGH Published 2021-04-19 Modified 2024-05-15 Official page ↗
Aliases
CVE-2020-36320
Ecosystem
Maven
Packages
com.vaadin:vaadin-bom, com.vaadin:vaadin-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-04-16

Affected packages

• Maven com.vaadin:vaadin-bom: >= 7.0.0.beta1, < 7.7.22 → fixed in 7.7.22 • Maven com.vaadin:vaadin-server: >= 7.0.0.beta1, < 7.7.22 → fixed in 7.7.22

Description

Unsafe validation RegEx in `EmailValidator` class in `com.vaadin:vaadin-server` versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. • https://vaadin.com/security/cve-2020-36320

Related

Alias · CVE (1)

  • CVE-2020-36320 Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21)… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References