Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages cou...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 node-redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2+~cs5.18.1-3"}]}]

Debian:13 node-redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2+~cs5.18.1-3"}]}]

Debian:14 node-redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2+~cs5.18.1-3"}]}]

参照URL

advisory security-tracker.debian.org