Description (CNA)
A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| yarnpkg / Yarn | affected 1.22.0; affected 1.22.1; affected 1.22.2; affected 1.22.3; affected 1.22.4; affected 1.22.5; affected 1.22.6; affected 1.22.7; affected 1.22.8; affected 1.22.9; affected 1.22.10; affected 1.22.11; affected 1.22.12; affected 1.22.13; affected 1.22.14; affected 1.22.15; affected 1.22.16; affected 1.22.17; affected 1.22.18; affected 1.22.19; affected 1.22.20; affected 1.22.21; affected 1.22.22 |
CWE
CWE-1333, CWE-400
References
- https://vuldb.com/?id.317850
- https://vuldb.com/?ctiid.317850
- https://vuldb.com/?submit.617393
- https://github.com/yarnpkg/yarn/pull/9199
- https://github.com/yarnpkg/yarn/pull/9199/commits/97731871e674bf93bcbf29e9d3258da8685f3076
ADP enrichment
No English description supplied.
No references supplied.