What is GHSA-fp36-299x-pwmw?

GHSA-fp36-299x-pwmw is a security advisory published by GitHub Security Advisories with High severity. Regular expression denial of service in devcert

Which CVE IDs does GHSA-fp36-299x-pwmw cover?

GHSA-fp36-299x-pwmw covers the following CVE IDs: CVE-2022-1929. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fp36-299x-pwmw?

GHSA-fp36-299x-pwmw has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-fp36-299x-pwmw?

GHSA-fp36-299x-pwmw affects 1 product, including: npm/devcert:\u003c 1.2.1.

GHSA-fp36-299x-pwmwHighCVSS 7.5

Regular expression denial of service in devcert

Vendor

GitHub Security Advisories

Published

June 3, 2022

Last Modified

November 29, 2023

🔗 CVE IDs covered (1)

CVE-2022-1929 →

📋 Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

🎯 Affected products1

npm/devcert:< 1.2.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-1929
https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352/
https://github.com/davewasmer/devcert/commit/b0763215f6683271d296fda98f7ef7bcd4a55977
https://github.com/advisories/GHSA-fp36-299x-pwmw