CVE-2023-50249 Sentry's Astro SDK vulnerable to ReDoS
An attacker can cause server denial of service via excessive computation in the Sentry Astro SDK, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-50249?
CVE-2023-50249 is a high-severity denial of service vulnerability in getsentry sentry-javascript, published on 20 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry's Astro SDK 7.78.0-7.86.0. Under certain conditions, this vulnerability allows an attacker to cause excessive computation times on the server, leading to denial of service (DoS). This vulnerability has been patched in sentry/astro version 7.87.0.
Which versions are affected by CVE-2023-50249?
2 open source packages ship an affected version, including @sentry/astro. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@sentry/astro npm | From 7.78.0 | 7.87.0 |
@sentry/astro npm | From 7.78.0 | 7.87.0 |
Products include Sentry Astro.
How do I fix CVE-2023-50249?
Upgrade @sentry/astro to 7.87.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-50249 being exploited?
There is no known exploitation of CVE-2023-50249 in the wild and no public exploit code.
Sources
Also known as GHSA-x3v3-8xg8-8v72.