GHSA-pcqq-5962-hvcw Denial of Service in uap-core when processing crafted User-Agent strings
Remote attackers can cause denial of service in applications using uap-core by sending crafted User-Agent strings that trigger regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-pcqq-5962-hvcw?
GHSA-pcqq-5962-hvcw is a denial of service vulnerability in user_agent_parser, published on 10 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
Patches
Please update uap-ruby to >= v2.6.0
For more information
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
Reported in uap-core by Ben Caller @bcaller
Which versions are affected by GHSA-pcqq-5962-hvcw?
2 open source packages ship an affected version, including user_agent_parser.
| Package | Affected | Fixed in |
|---|---|---|
user_agent_parser RubyGems | All versions | 2.6.0 |
user_agent_parser RubyGems | All versions | 2.6.0 |
How do I fix GHSA-pcqq-5962-hvcw?
Upgrade user_agent_parser to 2.6.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-pcqq-5962-hvcw being exploited?
There is no known exploitation of GHSA-pcqq-5962-hvcw in the wild and no public exploit code.