NodeJS/semver/1.0.2
The semantic version parser used by npm.
https://www.npmjs.com/package/semver
ISC
1 Security Vulnerabilities
Regular Expression Denial of Service
Published date: 2015-04-04
CVEs: ["CVE-2015-8855"]
CVSS Score: 5.3
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Coordinating vendor: ^Lift Security
Links:
semver is vulnerable to regular expression denial of service (ReDoS) when extremely long version strings are parsed.
The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.
[1]
Affected versions: ["1.0.0", "1.0.1", "1.0.2", "1.0.3", "1.0.4", "1.0.5", "1.0.6", "1.0.7", "1.0.8", "1.0.9", "1.0.10", "1.0.11", "1.0.12", "1.0.13", "1.0.14", "1.1.0", "1.1.1", "1.1.2", "1.1.3", "1.1.4", "2.0.0-alpha", "2.0.0-beta", "2.0.1", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9", "2.0.10", "2.0.11", "2.1.0", "2.2.0", "2.2.1", "2.3.0", "2.3.1", "2.3.2", "3.0.0", "3.0.1", "4.0.0", "4.0.2", "4.0.3", "4.1.0", "4.1.1", "4.2.0", "4.2.1", "4.2.2", "4.3.0", "4.3.1", "NodeJS/semver/1.0.0", "NodeJS/semver/1.0.1", "NodeJS/semver/1.0.3", "NodeJS/semver/1.0.4", "NodeJS/semver/1.0.6", "NodeJS/semver/1.0.8", "NodeJS/semver/1.0.10", "NodeJS/semver/1.0.11", "NodeJS/semver/1.0.12", "NodeJS/semver/1.0.13", "NodeJS/semver/1.1.0", "NodeJS/semver/1.1.2", "NodeJS/semver/1.1.4", "NodeJS/semver/2.0.0-alpha", "NodeJS/semver/2.0.0-beta", "NodeJS/semver/2.0.1", "NodeJS/semver/2.0.2", "NodeJS/semver/2.0.4", "NodeJS/semver/2.0.5", "NodeJS/semver/2.0.7", "NodeJS/semver/2.0.10", "NodeJS/semver/2.0.11", "NodeJS/semver/2.1.0", "NodeJS/semver/2.2.1", "NodeJS/semver/2.3.0", "NodeJS/semver/2.3.2", "NodeJS/semver/3.0.0", "NodeJS/semver/3.0.1", "NodeJS/semver/4.0.0", "NodeJS/semver/4.0.2", "NodeJS/semver/4.2.0", "NodeJS/semver/4.3.0", "NodeJS/semver/4.3.1", "NodeJS/semver/1.0.2", "NodeJS/semver/1.0.5", "NodeJS/semver/1.0.7", "NodeJS/semver/1.0.9", "NodeJS/semver/1.0.14", "NodeJS/semver/1.1.1", "NodeJS/semver/1.1.3", "NodeJS/semver/2.0.3", "NodeJS/semver/2.0.6", "NodeJS/semver/2.0.8", "NodeJS/semver/2.0.9", "NodeJS/semver/2.2.0", "NodeJS/semver/2.3.1", "NodeJS/semver/4.0.3", "NodeJS/semver/4.1.0", "NodeJS/semver/4.1.1", "NodeJS/semver/4.2.1", "NodeJS/semver/4.2.2"]
Secure versions: [5.7.2, 6.3.1, 7.5.2, 7.5.3, 7.5.4, 7.6.0, 7.6.1, 7.6.2, 7.6.3, 7.7.0, 7.7.1, 7.7.2, 7.7.3, 7.7.4]
Recommendation: Update to a version 4.3.2 or greater
113 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 5.2.0 | ISC | 1 | 2016-06-28 - 18:00 | over 9 years |
| 5.1.1 | ISC | 1 | 2016-06-23 - 18:00 | almost 10 years |
| 5.1.0 | ISC | 1 | 2015-11-18 - 23:18 | over 10 years |
| 5.0.3 | ISC | 1 | 2015-09-11 - 20:27 | over 10 years |
| 5.0.2 | ISC | 1 | 2015-09-11 - 17:09 | over 10 years |
| 5.0.1 | ISC | 1 | 2015-07-13 - 20:02 | over 10 years |
| 5.0.0 | ISC | 1 | 2015-07-11 - 17:29 | over 10 years |
| 4.3.6 | ISC | 1 | 2015-06-01 - 04:16 | almost 11 years |
| 4.3.5 | ISC | 1 | 2015-05-29 - 22:25 | almost 11 years |
| 4.3.4 | ISC | 1 | 2015-05-05 - 04:26 | almost 11 years |
| 4.3.3 | BSD | 1 | 2015-03-27 - 16:56 | almost 11 years |
| 4.3.2 | BSD | 1 | 2015-03-27 - 01:26 | about 11 years |
| 4.3.1 | BSD | 3 | 2015-02-24 - 19:49 | about 11 years |
| 4.3.0 | BSD | 3 | 2015-02-12 - 20:08 | about 11 years |
| 4.2.2 | BSD | 3 | 2015-02-10 - 06:46 | about 11 years |
| 4.2.1 | BSD | 3 | 2015-02-10 - 06:44 | about 11 years |
| 4.2.0 | BSD | 3 | 2014-12-23 - 09:42 | over 11 years |
| 4.1.1 | BSD | 3 | 2014-12-19 - 12:57 | over 11 years |
| 4.1.0 | BSD | 3 | 2014-10-16 - 00:55 | over 11 years |
| 4.0.3 | BSD | 3 | 2014-10-01 - 00:18 | over 11 years |
| 4.0.2 | BSD | 3 | 2014-09-30 - 23:55 | over 11 years |
| 4.0.0 | BSD | 3 | 2014-09-11 - 22:36 | over 11 years |
| 3.0.1 | BSD | 3 | 2014-07-24 - 17:24 | over 11 years |
| 3.0.0 | BSD | 3 | 2014-07-23 - 21:14 | over 11 years |
| 2.3.2 | BSD | 3 | 2014-07-22 - 19:24 | over 11 years |
| 2.3.1 | BSD | 3 | 2014-06-18 - 22:48 | almost 12 years |
| 2.3.0 | BSD | 3 | 2014-05-07 - 01:15 | almost 12 years |
| 2.2.1 | BSD | 3 | 2013-10-28 - 18:18 | over 12 years |
| 2.2.0 | BSD | 3 | 2013-10-25 - 20:02 | over 12 years |
| 2.1.0 | BSD | 3 | 2013-08-01 - 23:52 | over 12 years |
| 2.0.11 | BSD | 3 | 2013-07-24 - 03:23 | over 12 years |
| 2.0.10 | BSD | 3 | 2013-07-09 - 22:39 | over 12 years |
| 2.0.9 | BSD | 3 | 2013-07-06 - 03:45 | over 12 years |
| 2.0.8 | BSD | 3 | 2013-06-24 - 22:12 | almost 13 years |
| 2.0.7 | BSD | 3 | 2013-06-20 - 18:57 | almost 13 years |
| 2.0.6 | BSD | 3 | 2013-06-20 - 18:41 | almost 13 years |
| 2.0.5 | BSD | 3 | 2013-06-20 - 15:42 | almost 13 years |
| 2.0.4 | BSD | 3 | 2013-06-20 - 15:33 | almost 13 years |
| 2.0.3 | BSD | 3 | 2013-06-20 - 15:15 | almost 13 years |
| 2.0.2 | BSD | 3 | 2013-06-20 - 15:05 | almost 13 years |
| 2.0.1 | BSD | 3 | 2013-06-20 - 04:42 | almost 13 years |
| 2.0.0-beta | BSD | 3 | 2013-06-18 - 00:01 | almost 13 years |
| 2.0.0-alpha | BSD | 3 | 2013-06-15 - 03:29 | almost 13 years |
| 1.1.4 | MIT | 2 | 2013-03-01 - 18:14 | about 13 years |
| 1.1.3 | MIT | 2 | 2013-02-06 - 15:42 | about 13 years |
| 1.1.2 | MIT | 2 | 2013-01-06 - 16:25 | about 13 years |
| 1.1.1 | MIT | 2 | 2012-11-29 - 00:46 | over 13 years |
| 1.1.0 | MIT | 2 | 2012-10-02 - 17:02 | over 13 years |
| 1.0.14 | MIT | 2 | 2012-05-27 - 00:47 | almost 14 years |
| 1.0.13 | MIT | 2 | 2011-12-21 - 17:07 | over 14 years |