GitHub Advisoryadvisory · npm
GHSA-4hpf-3wq7-5rpr Regular expression deinal of service (ReDoS) in is-my-json-valid
MEDIUM
Official page ↗
- Aliases
- CVE-2018-1107
- Ecosystem
- npm
- Packages
- is-my-json-valid
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-400
- Reviewed
- 2021-03-31
Affected packages
• npm is-my-json-valid: >= 2.0.0, < 2.17.2 → fixed in 2.17.2
• npm is-my-json-valid: < 1.4.1 → fixed in 1.4.1
Description
It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
Related
Alias · CVE (1)
- CVE-2018-1107 It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to… vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1107 advisory
- https://github.com/mafintosh/is-my-json-valid/pull/159 web
- https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976 web
- https://bugzilla.redhat.com/show_bug.cgi?id=1546357 web
- https://snyk.io/vuln/npm:is-my-json-valid:20180214 web