GitHub Advisoryadvisory · npm, NuGet
GHSA-jxwx-85vp-gvwm Regular Expression Denial of Service in jquery-validation
HIGH
Official page ↗
- Aliases
- CVE-2021-21252
- Ecosystem
- npm, NuGet
- Packages
- jquery-validation, jQuery.Validation
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2021-01-13
Affected packages
• npm jquery-validation: < 1.19.3 → fixed in 1.19.3
• NuGet jQuery.Validation: < 1.19.3 → fixed in 1.19.3
Description
The GitHub Security Lab team has identified potential security vulnerabilities in jquery.validation.
The project contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service)
This issue was discovered and reported by GitHub team member @erik-krogh (Erik Krogh Kristensen).
Related
Alias · CVE (1)
- CVE-2021-21252 The jQuery Validation Plugin provides drop-in validation for your existing forms. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm web
- https://nvd.nist.gov/vuln/detail/CVE-2021-21252 advisory
- https://github.com/jquery-validation/jquery-validation/pull/2371 web
- https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7d web
- https://github.com/jquery-validation/jquery-validation package
- https://jqueryvalidation.org/#installation-via-package-managers web
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html web
- https://security.netapp.com/advisory/ntap-20210219-0005 web
- https://securitylab.github.com/advisories/GHSL-2020-294-redos-jquery-validation advisory
- https://www.npmjs.com/package/jquery-validation web
- https://www.nuget.org/packages/jquery.validation web