CVE-2023-23925
Switcher Client contains Regular Expression Denial of Service (ReDoS)
Summary
Switcher Client contains Regular Expression Denial of Service (ReDoS)
Original description
The description as published by the source.
Impact
Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS).
Patches
Patched in 3.1.4
Workarounds
Avoid using Strategy settings that use REGEX in conjunction with EXIST and NOT_EXIST operations.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
switcher-client
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.4"}]}]
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com