{
"id": "GHSA-9fhw-r42p-5c7r",
"aliases": [
"CVE-2021-27405"
],
"details": "### Impact\n\nA [Regular expression Denial of Service](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js.\nThe attacker that is able to be parsed a specially crafted text may cause the application to consume an excessive amount of CPU.\n\n### Patches\n\nUpgrade to version 6.0.3, 7.0.2 or later.\n\n### Workarounds\n\nAvoid to parse text with a lot of `[` chars.\n\n### References\n\n* https://github.com/progfay/scrapbox-parser/pull/519\n* https://github.com/progfay/scrapbox-parser/pull/539\n* https://github.com/progfay/scrapbox-parser/pull/540\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-27405\n* https://snyk.io/vuln/SNYK-JS-PROGFAYSCRAPBOXPARSER-1076803\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/progfay/scrapbox-parser](https://github.com/progfay/scrapbox-parser/issues)",
"summary": "Regular expression Denial of Service in @progfay/scrapbox-parser",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.3"
}
]
}
],
"package": {
"name": "@progfay/scrapbox-parser",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.2"
}
]
}
],
"package": {
"name": "@progfay/scrapbox-parser",
"ecosystem": "npm"
}
}
],
"modified": "2021-02-26T19:49:07Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"published": "2021-03-01T20:44:44Z",
"references": [
{
"url": "https://github.com/progfay/scrapbox-parser/security/advisories/GHSA-9fhw-r42p-5c7r",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27405",
"type": "ADVISORY"
},
{
"url": "https://github.com/progfay/scrapbox-parser/pull/519",
"type": "WEB"
},
{
"url": "https://github.com/progfay/scrapbox-parser/pull/539",
"type": "WEB"
},
{
"url": "https://github.com/progfay/scrapbox-parser/pull/540",
"type": "WEB"
},
{
"url": "https://security.netapp.com/advisory/ntap-20210326-0002",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2021-02-19T05:15:00Z",
"github_reviewed_at": "2021-02-26T19:49:07Z"
}
}