High severityNVD Advisory· Published Mar 12, 2021· Updated Aug 3, 2024
CVE-2021-27290
CVE-2021-27290
Description
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ssrinpm | >= 5.2.2, < 6.0.2 | 6.0.2 |
ssrinpm | >= 7.0.0, < 7.1.1 | 7.1.1 |
ssrinpm | >= 8.0.0, < 8.0.1 | 8.0.1 |
Affected products
62- ssri/ssridescription
- ghsa-coords61 versionspkg:npm/ssripkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packagingpkg:rpm/opensuse/nodejs10&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nodejs10&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/nodejs12&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nodejs12&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/nodejs14&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nodejs14&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/nodejs14&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs8&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nodejs8&distro=openSUSE%20Leap%2015.3pkg:rpm/suse/nodejs10&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/nodejs10&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/nodejs10&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/nodejs10&distro=SUSE%20Manager%20Server%204.0pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP3pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP3pkg:rpm/suse/nodejs8&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/nodejs8&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/nodejs8&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/nodejs8&distro=SUSE%20Manager%20Server%204.0pkg:rpm/suse/nodejs-common&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/nodejs-common&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/nodejs-common&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/nodejs-common&distro=SUSE%20Manager%20Server%204.0
>= 5.2.2, < 6.0.2+ 60 more
- (no CPE)range: >= 5.2.2, < 6.0.2
- (no CPE)range: < 2.0.3-1.module_el8.4.0+2521+c668cc9f
- (no CPE)range: < 17-3.module_el8.4.0+2224+b07ac28e
- (no CPE)range: < 10.24.1-lp152.2.15.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 12.22.2-lp152.3.15.1
- (no CPE)range: < 12.22.2-4.16.1
- (no CPE)range: < 14.17.2-lp152.11.1
- (no CPE)range: < 14.17.2-5.12.1
- (no CPE)range: < 14.17.5-1.2
- (no CPE)range: < 8.17.0-lp152.3.14.1
- (no CPE)range: < 8.17.0-10.12.2
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.39.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 10.24.1-1.36.1
- (no CPE)range: < 12.22.2-1.32.1
- (no CPE)range: < 12.22.2-4.16.1
- (no CPE)range: < 12.22.2-4.16.1
- (no CPE)range: < 14.17.2-6.12.1
- (no CPE)range: < 14.17.2-5.12.1
- (no CPE)range: < 14.17.2-5.12.1
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-10.12.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
Patches
Vulnerability mechanics
References
12- github.com/advisories/GHSA-vx3p-948g-6vhqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-27290ghsaADVISORY
- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfghsax_refsource_CONFIRMWEB
- doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdfghsax_refsource_MISCWEB
- github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2ghsaWEB
- github.com/npm/ssri/commit/809c84d09ea87c3857fa171d42914586899d4538ghsaWEB
- github.com/npm/ssri/commit/b30dfdb00bb94ddc49a25a85a18fb27afafdfbb1ghsaWEB
- github.com/npm/ssri/pull/20ghsaWEB
- github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdfghsax_refsource_MISCWEB
- npmjs.comghsax_refsource_MISCWEB
- www.npmjs.com/package/ssrighsaWEB
- www.oracle.com/security-alerts/cpuoct2021.htmlghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.