Fix CVE–2021–23343

[debricked]

CVE–2021–23343

Vulnerable dependency:     path-parse (npm)    1.0.6

Vulnerability details

Description

NVD

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

GitHub

Regular Expression Denial of Service in path-parse

Affected versions of npm package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

CVSS details - 7.5

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity	None
Availability	High

References

    THIRD PARTY
    Regular Expression Denial of Service in path-parse · CVE-2021-23343 · GitHub Advisory Database · GitHub
    ReDoS in path-parse · Issue #8 · jbgutierrez/path-parse · GitHub
    MLIST
    fixed regexes to avoid ReDoS attacks by jeffrey-pinyan-ithreat · Pull Request #10 · jbgutierrez/path-parse · GitHub
    Merge pull request #10 from jeffrey-pinyan-ithreat/master · jbgutierrez/path-parse@eca63a7 · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE