Vulnerabilities > CVE-2021-21317 - Unspecified vulnerability in Uap-Core Project Uap-Core

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

LOW

network

low complexity

uap-core-project

NVD

Published: 2021-02-16

Updated: 2024-11-21

Summary

uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.

Vulnerable Configurations

Part	Description	Count
Application	Uap-Core_Project UAP Core Project UAP Core 0.1.0 UAP Core Project UAP Core 0.1.1 UAP Core Project UAP Core 0.1.2 UAP Core Project UAP Core 0.2.0 UAP Core Project UAP Core 0.2.1 UAP Core Project UAP Core 0.2.2 UAP Core Project UAP Core 0.2.3 UAP Core Project UAP Core 0.2.4 UAP Core Project UAP Core 0.3.0 UAP Core Project UAP Core 0.3.1 UAP Core Project UAP Core 0.3.2 UAP Core Project UAP Core 0.3.4 UAP Core Project UAP Core 0.4.0 UAP Core Project UAP Core 0.5.0 UAP Core Project UAP Core 0.6.0 UAP Core Project UAP Core 0.6.1 UAP Core Project UAP Core 0.6.2 UAP Core Project UAP Core 0.6.3 UAP Core Project UAP Core 0.6.4 UAP Core Project UAP Core 0.6.5 UAP Core Project UAP Core 0.6.6 UAP Core Project UAP Core 0.6.7 UAP Core Project UAP Core 0.6.8 UAP Core Project UAP Core 0.6.9 UAP Core Project UAP Core 0.6.11 UAP Core Project UAP Core 0.7.0 UAP Core Project UAP Core 0.7.1 UAP Core Project UAP Core 0.7.2 UAP Core Project UAP Core 0.7.3 UAP Core Project UAP Core 0.8.0 UAP Core Project UAP Core 0.9.0 UAP Core Project UAP Core 0.10.0	32

Summary

Vulnerable Configurations

References