CVE-2018-1107

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1546357	Issue Tracking Patch Third Party Advisory
https://snyk.io/vuln/npm:is-my-json-valid:20180214	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:is-my-json-valid_project:is-my-json-valid::::::node.js::*
	cpe:2.3:a:is-my-json-valid_project:is-my-json-valid::::::node.js::*

History

No history.

Information

Published : 2021-03-30 02:15

Updated : 2024-02-28 18:28

NVD link : CVE-2018-1107

Mitre link : CVE-2018-1107

CVE.ORG link : CVE-2018-1107

JSON object : View

Products Affected

is-my-json-valid_project

is-my-json-valid

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2018-1107", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2021-03-30T02:15:14.593", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1546357", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://snyk.io/vuln/npm:is-my-json-valid:20180214", "tags": ["Exploit", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated."}, {"lang": "es", "value": "Se detect\u00f3 que la biblioteca de JavaScript is-my-json-valid usaba una expresi\u00f3n regular ineficiente para comprobar los campos JSON definidos para tener formato de correo electr\u00f3nico. Un archivo JSON especialmente dise\u00f1ado podr\u00eda hacer que consuma una cantidad excesiva de tiempo de CPU cuando se comprueba."}], "lastModified": "2021-04-02T15:16:52.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:is-my-json-valid_project:is-my-json-valid:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "67DFDA57-B2DF-49CD-A01A-129D1822C439", "versionEndExcluding": "1.4.1"}, {"criteria": "cpe:2.3:a:is-my-json-valid_project:is-my-json-valid:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0A073C02-9957-4C9A-9E7F-153F3475729B", "versionEndExcluding": "2.17.2", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}