Resource exhaustion in UAParser.js - CVE-2021-27292
Published: August 9, 2021
Vulnerability identifier: #VU55667
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-27292
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a regular expression denial of service (ReDoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing a malicious User-Agent header. A remote attacker can trigger resource exhaustion and perform a regular expression denial of service (ReDoS) attack.
Affected software
UAParser.js
OpenShift Logging
Red Hat OpenShift Jaeger
IBM Security QRadar Analyst Workflow
OpenShift Logging
Red Hat OpenShift Jaeger
IBM Security QRadar Analyst Workflow
How to mitigate CVE-2021-27292
Install updates from vendor's website.
UAParser.js - update to 0.7.24
OpenShift Logging - addressed in versions 5.1.7, 5.2.6, 5.3.3
Red Hat OpenShift Jaeger - update to 1.24.0
IBM Security QRadar Analyst Workflow - update to 2.15.1
OpenShift Logging - addressed in versions 5.1.7, 5.2.6, 5.3.3
Red Hat OpenShift Jaeger - update to 1.24.0
IBM Security QRadar Analyst Workflow - update to 2.15.1
External References
Related Security Bulletins
- ReDoS vulnerability in UAParser.js library
- Multiple vulnerabilities in Red Hat OpenShift Jaeger
- Multiple vulnerabilities in OpenShift Logging
- Multiple vulnerabilities in Red Hat OpenShift Enterprise Logging
- Multiple vulnerabilities in Red Hat OpenShift Enterprise Logging
- Multiple vulnerabilities in IBM Security QRadar Analyst Workflow