CVE-2020-26306

Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

CVSS

No CVSS.

References

Link	Resource
https://github.com/benhmoore/Knwl/issues/106
https://securitylab.github.com/advisories/GHSL-2020-296-redos-Knwl.js/

Configurations

No configuration.

History

28 Oct 2024, 13:58

Type	Values Removed	Values Added
Summary		(es) Knwl.js es una librería de Javascript que analiza textos en busca de fechas, horas, números de teléfono, correos electrónicos, lugares y más. Las versiones 1.0.2 y anteriores contienen una o más expresiones regulares que son vulnerables a la denegación de servicio por expresión regular (ReDoS). Al momento de la publicación, no se conocen parches disponibles.

26 Oct 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-26 21:15

Updated : 2024-10-28 13:58

NVD link : CVE-2020-26306

Mitre link : CVE-2020-26306

CVE.ORG link : CVE-2020-26306

JSON object : View

Products Affected

No product.

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2020-26306", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.7, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-10-26T21:15:13.883", "references": [{"url": "https://github.com/benhmoore/Knwl/issues/106", "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2020-296-redos-Knwl.js/", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available."}, {"lang": "es", "value": "Knwl.js es una librer\u00eda de Javascript que analiza textos en busca de fechas, horas, n\u00fameros de tel\u00e9fono, correos electr\u00f3nicos, lugares y m\u00e1s. Las versiones 1.0.2 y anteriores contienen una o m\u00e1s expresiones regulares que son vulnerables a la denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS). Al momento de la publicaci\u00f3n, no se conocen parches disponibles."}], "lastModified": "2024-10-28T13:58:09.230", "sourceIdentifier": "security-advisories@github.com"}