Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Core: fixed Regular Expression Denial of Service vulnerability#2371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
staabm merged 1 commit intojquery-validation:masterfromstaabm:re-dos
Jan 9, 2021

Conversation

staabm
Copy link
Member

@staabmstaabm commentedJan 9, 2021•
edited
Loading

ReDoS, or Regular Expression Denial of Service, is a vulnerability affecting
poorly constructed and potentially inefficient regular expressions which can
make them perform extremely badly given a creatively constructed input string.

GHSL-2020-294

credits to@erik-krogh for reporting the issue and providing a fix

for details seeGHSA-jxwx-85vp-gvwm

ReDoS, or Regular Expression Denial of Service, is a vulnerability affectingpoorly constructed and potentially inefficient regular expressions which canmake them perform extremely badly given a creatively constructed input string.GHSL-2020-294credits to@erik-krogh for reporting the issue and providing a fix
@staabm
Copy link
MemberAuthor

@pwntester I don't know what went wrong, but I opened the PR with the fix now manually, as the security advisory no longer allows me to access the private fork, so I could open a PR

@staabmstaabm merged commit5d8f29e intojquery-validation:masterJan 9, 2021
@staabmstaabm deleted the re-dos branchJanuary 9, 2021 15:28
@staabm
Copy link
MemberAuthor

staabm commentedJan 9, 2021•
edited
Loading

@erik-krogh sorry for not giving proper credit via git commit autorship. I somehow fucked up the patching of the vulnerability.

the process using the gh security audit was not clear to me.

erik-krogh reacted with thumbs up emoji

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

1 participant
@staabm
[8]ページ先頭
©2009-2025 Movatter.jp