Is CVE-2016-2537 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-2537 being exploited in the wild.

How severe is CVE-2016-2537?

Low severity, with a CVSS score of 3, published 24 October 2017.

Which products and versions are affected?

is-my-json-valid (npm) SEMVER:introduced=0,fixed=2.12.4.

Is there a fix for CVE-2016-2537?

Yes. is-my-json-valid (npm): upgrade to 2.12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-2537 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-2537?

Check whether you run is-my-json-valid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-2537: is-my-json-valid regular expression denial of service in email validation

CVE-2016-2537 · Severity: low · CVSS 3 · Published 2017-10-24

is-my-json-valid is a Node.js library used to validate JSON data against schemas. A flaw in its email validation logic allows attackers to craft malicious input that causes the library to consume excessive CPU resources, resulting in denial of service for any application using this validation function.

Technologies: is-my-json-valid (npm). Vendors: npm.

Quick answers

Is CVE-2016-2537 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-2537 being exploited in the wild.
How severe is CVE-2016-2537?: Low severity, with a CVSS score of 3, published 24 October 2017.
Which products and versions are affected?: is-my-json-valid (npm) SEMVER:introduced=0,fixed=2.12.4.
Is there a fix for CVE-2016-2537?: Yes. is-my-json-valid (npm): upgrade to 2.12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-2537 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-2537?: Check whether you run is-my-json-valid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

is-my-json-valid (npm): upgrade to 2.12.4 or later
```
npm install is-my-json-valid@2.12.4
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the email validation function of is-my-json-valid versions before 2.12.4. The underlying cause is a poorly-constructed regular expression that exhibits catastrophic backtracking when processing specially-crafted email strings. An attacker can send a malicious JSON payload with a crafted email field to any application using the library for validation, causing the regex engine to hang and consume CPU resources, leading to denial of service. No authentication or special privileges are required; the vulnerability is triggered via network-supplied input. The fix is available in version 2.12.4 and later.

Affected products

mafintosh is-my-json-valid before 2.12.4

Identifiers

CVE-2016-2537
GHSA-f522-ffg8-j8r6

Timeline

2016-02-23: disclosed
2016: patched: Version 2.12.4 released with fix
2017-10-24: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.