CVE-2022-24373 - OpenCVE

The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Swmansion	React Native Reanimated

Configuration 1 [-]

cpe:2.3:a:swmansion:react_native_reanimated:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/software-mansion/react-native-reanimated/pull/3382
https://github.com/software-mansion/react-native-reanimated/pull/3382/commits/7adf06d0c59382d884a04be86a96eede3d0432fa
https://github.com/software-mansion/react-native-reanimated/releases/tag/3.0.0-rc.1
https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507

History

No history.

MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2022-09-30T05:00:17.564918Z

Updated: 2024-09-16T18:13:28.552Z

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-24373

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-09-30T05:15:11.177

Modified: 2023-08-08T14:22:24.967

Link: CVE-2022-24373

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "react-native-reanimated", "vendor": "n/a", "versions": [{"lessThan": "3.0.0-rc.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "matias-la"}], "datePublic": "2022-09-30T00:00:00", "descriptions": [{"lang": "en", "value": "The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "exploitCodeMaturity": "PROOF_OF_CONCEPT", "integrityImpact": "NONE", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Regular Expression Denial of Service (ReDoS)", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-09-30T05:00:17", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/software-mansion/react-native-reanimated/pull/3382"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/software-mansion/react-native-reanimated/pull/3382/commits/7adf06d0c59382d884a04be86a96eede3d0432fa"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/software-mansion/react-native-reanimated/releases/tag/3.0.0-rc.1"}], "title": "Regular Expression Denial of Service (ReDoS)", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2022-09-30T05:00:01.672924Z", "ID": "CVE-2022-24373", "STATE": "PUBLIC", "TITLE": "Regular Expression Denial of Service (ReDoS)"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "react-native-reanimated", "version": {"version_data": [{"version_affected": "<", "version_value": "3.0.0-rc.1"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "matias-la"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Regular Expression Denial of Service (ReDoS)"}]}]}, "references": {"reference_data": [{"name": "https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507", "refsource": "MISC", "url": "https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507"}, {"name": "https://github.com/software-mansion/react-native-reanimated/pull/3382", "refsource": "MISC", "url": "https://github.com/software-mansion/react-native-reanimated/pull/3382"}, {"name": "https://github.com/software-mansion/react-native-reanimated/pull/3382/commits/7adf06d0c59382d884a04be86a96eede3d0432fa", "refsource": "MISC", "url": "https://github.com/software-mansion/react-native-reanimated/pull/3382/commits/7adf06d0c59382d884a04be86a96eede3d0432fa"}, {"name": "https://github.com/software-mansion/react-native-reanimated/releases/tag/3.0.0-rc.1", "refsource": "MISC", "url": "https://github.com/software-mansion/react-native-reanimated/releases/tag/3.0.0-rc.1"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:07:02.553Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/software-mansion/react-native-reanimated/pull/3382"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/software-mansion/react-native-reanimated/pull/3382/commits/7adf06d0c59382d884a04be86a96eede3d0432fa"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/software-mansion/react-native-reanimated/releases/tag/3.0.0-rc.1"}]}]}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2022-24373", "datePublished": "2022-09-30T05:00:17.564918Z", "dateReserved": "2022-02-24T00:00:00", "dateUpdated": "2024-09-16T18:13:28.552Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:swmansion:react_native_reanimated:*:*:*:*:*:*:*:*", "matchCriteriaId": "63054C32-E303-48CF-88ED-42080C51BECE", "versionEndExcluding": "2.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js."}, {"lang": "es", "value": "El paquete react-native-reanimated versiones anteriores a 3.0.0-rc.1, es vulnerable a una Denegaci\u00f3n de Servicio por Expresi\u00f3n Regular (ReDoS) debido a un uso no apropiado de la expresi\u00f3n regular en el analizador del archivo Colors.js"}], "id": "CVE-2022-24373", "lastModified": "2023-08-08T14:22:24.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2022-09-30T05:15:11.177", "references": [{"source": "report@snyk.io", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/software-mansion/react-native-reanimated/pull/3382"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/software-mansion/react-native-reanimated/pull/3382/commits/7adf06d0c59382d884a04be86a96eede3d0432fa"}, {"source": "report@snyk.io", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/software-mansion/react-native-reanimated/releases/tag/3.0.0-rc.1"}, {"source": "report@snyk.io", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "nvd@nist.gov", "type": "Primary"}]}