CVE-2022-25883: semver Regular Expression Denial of Service

CVE-2022-25883 · Severity: low · CVSS 3.1 · Published 2023-06-21

The semver library is a widely-used npm package that parses and compares software version numbers. A Regular Expression Denial of Service (ReDoS) vulnerability in the Range parsing function allows attackers to cause the application to hang or become unresponsive by providing specially crafted version range inputs. This can lead to service unavailability for any application that uses semver to process untrusted version data.

Quick answers

Is CVE-2022-25883 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-25883 being exploited in the wild.
How severe is CVE-2022-25883?
Low severity, with a CVSS score of 3.1, published 21 June 2023.
Which products and versions are affected?
Semver SEMVER:introduced=7.0.0,fixed=7.5.2.
Is there a fix for CVE-2022-25883?
Yes. Semver: upgrade to 7.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-25883 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-25883?
Check whether you run Semver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Semver: upgrade to 7.5.2 or later

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) issue in the semver library's Range constructor, specifically in the regular expressions used to parse version range strings. The vulnerable regexes in re.js (lines 138 and 160) can experience catastrophic backtracking when processing untrusted user input containing certain patterns. An attacker can provide malicious version range strings to the Range function, causing excessive CPU consumption and service denial. The vulnerability affects semver versions before 5.7.2 on the 5.x branch, before 6.3.1 on the 6.x branch, and before 7.5.2 on the 7.x branch. Patches were released in June 2023 to fix the underlying regex patterns.

Affected products

  • npm semver before 5.7.2, 6.0.0-6.3.0, 7.0.0-7.5.1

Identifiers

  • CVE-2022-25883
  • GHSA-c2qf-rxjj-qqgw

Timeline

  • 2023-06-21: disclosed
  • 2023-06-21: patched: Fixes released in versions 5.7.2, 6.3.1, and 7.5.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.