CoreCVE
Back

HIGH

Regular Expression Denial of Service (ReDoS)

Published Oct 27, 2020

Description

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

Affected products

Remediation

Red Hat statement

In Red Hat Enterprise Linux 8 and Software Collections, `npm-user-validate` is used exclusively for `npm`. As a result, this vulnerability is considered Low in such a context. In OpenShift Container Platform (OCP) 3.11 and 4.4 the kibana package has been marked Low (similar to RHEL8) as it is primarily used for npm and is protected via OpenShift OAuth. Additionally, whilst OCP 4.4 does deliver the kibana package, due to the code changing to container first content, it has been marked as wontfix at this time and may be fixed in a future release. Additionally, the openshift4/ose-logging-kibana6 container is not represented on the CVE page as it gets npm from the Red Hat Software Collections and as such the ose-logging-kibana6 container will be updated when the rh-nodejs10-nodejs package is.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner snyk
Published Oct 27, 2020
Updated Sep 17, 2024
Reserved Jan 21, 2020
Link CVE-2020-7754
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-7754
Red Hat
Severity Moderate
Public date Oct 16, 2020
Links CVE-2020-7754 - Bugzilla
GHSA-PW54-MH39-W3HC