Is CVE-2021-23392 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-23392 being exploited in the wild.

How severe is CVE-2021-23392?

Low severity, with a CVSS score of 3.1, published 10 June 2021.

Which products and versions are affected?

locutus (npm) SEMVER:introduced=0,fixed=2.0.15.

Is there a fix for CVE-2021-23392?

Yes. locutus (npm): upgrade to 2.0.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-23392 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-23392?

Check whether you run locutus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-23392: locutus Regular Expression Denial of Service in gopher_parsedir

CVE-2021-23392 · Severity: low · CVSS 3.1 · Published 2021-06-10

Locutus is a library that provides JavaScript implementations of standard functions from other programming languages. A vulnerability in its Gopher protocol parsing function allows an attacker to send specially crafted data that causes the system to freeze or become unresponsive. This can lead to a service outage, preventing legitimate users from accessing the application.

Technologies: locutus (npm). Vendors: npm.

Quick answers

Is CVE-2021-23392 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-23392 being exploited in the wild.
How severe is CVE-2021-23392?: Low severity, with a CVSS score of 3.1, published 10 June 2021.
Which products and versions are affected?: locutus (npm) SEMVER:introduced=0,fixed=2.0.15.
Is there a fix for CVE-2021-23392?: Yes. locutus (npm): upgrade to 2.0.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-23392 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-23392?: Check whether you run locutus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

locutus (npm): upgrade to 2.0.15 or later
```
npm install locutus@2.0.15
```

Technical details

The locutus package before version 2.0.15 is vulnerable to a Regular Expression Denial of Service (ReDoS) within the `gopher_parsedir` function. The vulnerability is caused by an inefficient regular expression (`entryPattern`) that uses nested quantifiers and non-greedy matching, leading to catastrophic backtracking when processing certain malformed input strings containing many tab characters. An unauthenticated remote attacker can exploit this by providing a crafted string to the function, causing the JavaScript engine to consume excessive CPU cycles. This results in a denial of service (DoS) condition. The issue was fixed in version 2.0.15 by optimizing the regular expression to use negated character classes.

Affected products

locutusjs locutus < 2.0.15

Identifiers

CVE-2021-23392
GHSA-39q4-p535-c852

Timeline

2021-04-05: disclosed: Vulnerability disclosed to vendor
2021-05-27: patched: Fix merged into master branch and released in version 2.0.15
2021-06-08: advisory: NVD published CVE-2021-23392

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.