Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    GHSA-MVMF-CVFX-QG55

    Vulnerability from github – Published: 2020-09-01 15:16 – Updated: 2021-09-23 21:06
    VLAI
    Summary
    Regular Expression Denial of Service in bleach
    Details

    All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function.

    Recommendation

    The bleach package is not currently maintained, and has not seen an update since 2014.

    To mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality. There are multiple modules fitting this criteria available on npm..

    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    Show details on source website
    To clipboard 

    {
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "bleach"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2014-8881"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:09:10Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function.\n\n\n\n## Recommendation\n\nThe `bleach` package is not currently maintained, and has not seen an update since 2014. \n\nTo mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=html%20sanitizer\u0026page=1\u0026ranking=optimal).",
  "id": "GHSA-mvmf-cvfx-qg55",
  "modified": "2021-09-23T21:06:09Z",
  "published": "2020-09-01T15:16:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8881"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/npm:bleach:20151024"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/47"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Regular Expression Denial of Service in bleach"
}

    GSD-2014-8881

    Vulnerability from gsd - Updated: 2023-12-13 01:22
    Details
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
    Aliases
    Aliases
    CVE-2014-8881
    To clipboard 

    {
  "GSD": {
    "alias": "CVE-2014-8881",
    "id": "GSD-2014-8881"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-8881"
      ],
      "id": "GSD-2014-8881",
      "modified": "2023-12-13T01:22:49.633737Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2014-8881",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=0.0.0-alpha",
          "affected_versions": "All versions",
          "credit": "Adam Baldwin",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2015-10-24",
          "description": "bleach is vulnerable to regular expression denial of service (ReDoS) when certain types of input is passed into the sanitize function. This can lead to long processing time, hanging the process while they occur.",
          "fixed_versions": [],
          "identifier": "CVE-2014-8881",
          "identifiers": [
            "CVE-2014-8881"
          ],
          "package_slug": "npm/bleach",
          "pubdate": "2015-10-24",
          "solution": "There is no solution for this vulnerability at the moment.",
          "title": "Regular Expression Denial of Service",
          "urls": [
            "https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS"
          ],
          "uuid": "5141e1f4-79d8-4eb6-962b-f8a2a5c482df"
        }
      ]
    }
  }
}