This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-27292 →

DEBIAN-CVE-2021-27292

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Age...

Original description

The description as published by the source.

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 node-ua-parser-js

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.24+ds-1"}]}]

Debian:13 node-ua-parser-js

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.24+ds-1"}]}]

Debian:14 node-ua-parser-js

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.24+ds-1"}]}]

References

advisory security-tracker.debian.org