CVE-2021-27290

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 85%
VendorProductVersion
ssri_projectssri
5.2.2 ≤
𝑥
< 6.0.2
ssri_projectssri
7.0.0 ≤
𝑥
< 8.0.1
oraclegraalvm
20.3.3
oraclegraalvm
21.2.0
siemenssinec_infrastructure_network_services
𝑥
< 1.0.1.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-ssri
bullseye
8.0.1-2
fixed
buster
no-dsa
bookworm
9.0.1-2
fixed
sid
9.0.1-3
fixed
trixie
9.0.1-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-ssri
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
ignored
jammy
needed
impish
ignored
hirsute
ignored
groovy
ignored
focal
needed
bionic
not-affected
xenial
dne
trusty
dne
References
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf
https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdf
https://npmjs.com
https://www.oracle.com/security-alerts/cpuoct2021.html
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf
https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdf
https://npmjs.com
https://www.oracle.com/security-alerts/cpuoct2021.html