A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Weakness
The product specifies a regular expression in a way that causes data to be improperly matched or compared.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Braces | Braces_project | * | 2.3.1 (excluding) |
| Red Hat Quay 3 | RedHat | quay/quay-rhel8:v3.6.0-62 | * |
| Node-braces | Ubuntu | artful | * |
| Node-braces | Ubuntu | cosmic | * |
| Node-braces | Ubuntu | disco | * |
| Node-braces | Ubuntu | upstream | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/15.html
- https://cwe.mitre.org/data/definitions/6.html
- https://cwe.mitre.org/data/definitions/79.html