CVE-2023-23925
Switcher Client contains Regular Expression Denial of Service (ReDoS)
Résumé
Switcher Client contains Regular Expression Denial of Service (ReDoS)
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Impact
Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS).
Patches
Patched in 3.1.4
Workarounds
Avoid using Strategy settings that use REGEX in conjunction with EXIST and NOT_EXIST operations.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
npm
switcher-client
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.4"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com