Is CVE-2020-5243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-5243 being exploited in the wild.

How severe is CVE-2020-5243?

Low severity, with a CVSS score of 3.1, published 20 February 2020.

Which products and versions are affected?

uap-core (npm) SEMVER:introduced=0,fixed=0.7.3; user_agent_parser (RubyGems) ECOSYSTEM:introduced=0,fixed=2.6.0; Ua-Parser Uap-Ruby <2.6.0.

Is there a fix for CVE-2020-5243?

Yes. uap-core (npm): upgrade to 0.7.3 or later; user_agent_parser (RubyGems): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-5243 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-5243?

Check whether you run uap-core (npm), user_agent_parser (RubyGems) or Ua-Parser Uap-Ruby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-5243: uap-core ReDoS in User-Agent parsing

Q: Is there a fix for CVE-2020-5243?

Yes. uap-core (npm): upgrade to 0.7.3 or later; user_agent_parser (RubyGems): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-5243 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2020-5243?

Check whether you run uap-core (npm), user_agent_parser (RubyGems) or Ua-Parser Uap-Ruby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-5243 · Severity: low · CVSS 3.1 · Published 2020-02-20

uap-core is a library that parses User-Agent strings to identify devices and browsers. This vulnerability allows an attacker to send a maliciously crafted User-Agent header in HTTP requests that triggers catastrophic backtracking in the parser's regular expressions, causing the server to consume excessive CPU and become unresponsive. This can lead to denial of service affecting all users of the service.

Technologies: uap-core (npm). Vendors: npm, RubyGems.

Quick answers

Is CVE-2020-5243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-5243 being exploited in the wild.
How severe is CVE-2020-5243?: Low severity, with a CVSS score of 3.1, published 20 February 2020.
Which products and versions are affected?: uap-core (npm) SEMVER:introduced=0,fixed=0.7.3; user_agent_parser (RubyGems) ECOSYSTEM:introduced=0,fixed=2.6.0; Ua-Parser Uap-Ruby <2.6.0.
Is there a fix for CVE-2020-5243?: Yes. uap-core (npm): upgrade to 0.7.3 or later; user_agent_parser (RubyGems): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-5243 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-5243?: Check whether you run uap-core (npm), user_agent_parser (RubyGems) or Ua-Parser Uap-Ruby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

uap-core (npm): upgrade to 0.7.3 or later
```
npm install uap-core@0.7.3
```
user_agent_parser (RubyGems): upgrade to 2.6.0 or later
```
bundle update user_agent_parser
```

Technical details

Multiple regular expressions in uap-core contain overlapping capture groups that are vulnerable to regular expression denial of service (ReDoS). The affected regexes parse User-Agent strings for SmartWatch devices, Huawei devices, and HbbTV clients. The backtracking complexity is approximately cubic with respect to input length. An attacker can craft User-Agent strings (e.g., "SmartWatch(" followed by thousands of spaces and a trailing character) that trigger catastrophic backtracking, consuming CPU resources. The vulnerability is exploitable without authentication via HTTP User-Agent headers, which are commonly accepted from untrusted sources. Patches are available in uap-core v0.7.3 and uap-ruby v2.6.0.

Affected products

ua-parser uap-core <0.7.3
ua-parser uap-ruby <2.6.0

Identifiers

CVE-2020-5243
GHSA-cmcx-xhr8-3w9p

Timeline

2020-02-20: disclosed
2020-02-20: patched: uap-core v0.7.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.