Vulnerability · Published Jan 2, 2023 · Assigned by VulDB

CVE-2021-4299cronvel string-kit naturalSort.js naturalSort redos

Medium 4.3

In plain English

A medium-severity regular-expression denial of service in string-kit from cronvel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)1.0%top 36.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 0.12.8 is able to address this issue. The name of the patch is 9cac4c298ee92c1695b0695951f1488884a7ca73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217180.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	string-kit	0.12.8	GHSA-pfrm-4rjw-g9q5

Affected products (as reported)

Vendor	Product	Versions
cronvel	string-kit	0.12.00.12.10.12.20.12.30.12.40.12.50.12.60.12.7

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://vuldb.com/?id.217180 vdb-entry, technical-description
https://vuldb.com/?ctiid.217180 signature, permissions-required
https://github.com/cronvel/string-kit/commit/9cac4c298ee92c1695b0695951f1488884a7ca73 patch
https://github.com/cronvel/string-kit/releases/tag/v0.12.8 patch