CVE-2020-5243: Uncontrolled Resource Consumption

February 21, 2020 (updated February 25, 2020)

uap-core is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core

References

github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1
github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
nvd.nist.gov/vuln/detail/CVE-2020-5243

Code Behaviors & Features

Detect and mitigate CVE-2020-5243 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →