Vulnerability Description
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Uap-Core Project | Uap-Core | < 0.7.3 |
Related Weaknesses (CWE)
References
- https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8Patch
- https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9pExploitThird Party Advisory
- https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8Patch
- https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9pExploitThird Party Advisory
FAQ
What is CVE-2020-5243?
CVE-2020-5243 is a vulnerability with a CVSS score of 5.7 (MEDIUM). uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlap...
How severe is CVE-2020-5243?
CVE-2020-5243 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-5243?
Check the references section above for vendor advisories and patch information. Affected products include: Uap-Core Project Uap-Core.