Is CVE-2018-20164 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-20164 being exploited in the wild.

How severe is CVE-2018-20164?

Low severity, with a CVSS score of 3, published 6 March 2019.

Which products and versions are affected?

uap-core (npm) SEMVER:introduced=0,fixed=0.6.0.

Is there a fix for CVE-2018-20164?

Yes. uap-core (npm): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-20164 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-20164?

Check whether you run uap-core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-20164: UA-Parser uap-core regular expression denial of service

CVE-2018-20164 · Severity: low · CVSS 3 · Published 2019-03-06

UA-Parser is a widely-used library that identifies browser and device types from HTTP User-Agent headers. A flaw in its regular expression patterns allows attackers to craft malicious User-Agent strings with long digit sequences, causing the parsing logic to hang and consume CPU resources. This can be exploited remotely to degrade or disable services that depend on uap-core for user agent detection.

Technologies: uap-core (npm). Vendors: npm.

Quick answers

Is CVE-2018-20164 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-20164 being exploited in the wild.
How severe is CVE-2018-20164?: Low severity, with a CVSS score of 3, published 6 March 2019.
Which products and versions are affected?: uap-core (npm) SEMVER:introduced=0,fixed=0.6.0.
Is there a fix for CVE-2018-20164?: Yes. uap-core (npm): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-20164 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-20164?: Check whether you run uap-core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

uap-core (npm): upgrade to 0.6.0 or later
```
npm install uap-core@0.6.0
```

Technical details

This is a Regular Expression Denial of Service (ReDoS) vulnerability in the regex.yaml pattern definitions used by UA-Parser uap-core. The vulnerable regex patterns (such as `^(.*)/(\d+)\.?(\d+)?\.?(\d+)?\.?(\d+)? CFNetwork`) employ optional quantifiers and alternation that cause catastrophic backtracking when matched against a long string of digits. An attacker can trigger excessive CPU consumption by setting the User-Agent HTTP header to a value containing repeated digits, causing the regex engine to hang during parsing. The vulnerability affects all versions prior to 0.6.0, and since uap-core is the canonical regex definition, it affects all downstream implementations across multiple languages (Python, Node.js, PHP, etc.). The fix was released in version 0.6.0 and involved rewriting problematic regex patterns to avoid backtracking.

Affected products

UA-Parser uap-core before 0.6.0

Identifiers

CVE-2018-20164
GHSA-fx7m-j728-mjw3

Timeline

2018-07-30: disclosed: Issue reported on GitHub
2019-03-06: advisory: GHSA published
2019: patched: Fixed in version 0.6.0

References

https://github.com/ua-parser/uap-core/issues/332

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.