Vulnerability · Published Jan 13, 2021 · Assigned by GitHub_M
CVE-2021-21252Regular expression denial of service in jquery-validation
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in jquery-validation from jquery-validation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | phpmyadmin | 4:5.0.4+dfsg2-2 | DEBIAN-CVE-2021-21252 |
| Debian:13 | phpmyadmin | 4:5.0.4+dfsg2-2 | DEBIAN-CVE-2021-21252 |
| Debian:14 | phpmyadmin | 4:5.0.4+dfsg2-2 | DEBIAN-CVE-2021-21252 |
| NuGet | jquery.validation | 1.19.3 | GHSA-jxwx-85vp-gvwm |
| Ubuntu:22.04:LTS | otrs2 | no fix listed | UBUNTU-CVE-2021-21252 |
| npm | jquery-validation | 1.19.3 | GHSA-jxwx-85vp-gvwm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jquery-validation | jquery-validation | < 1.19.3 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm
- https://github.com/jquery-validation/jquery-validation/pull/2371
- https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7d
- https://www.npmjs.com/package/jquery-validation
- https://security.netapp.com/advisory/ntap-20210219-0005/
- [debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update mailing-list