Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47003?format=api",
    "vulnerability_id": "VCID-ucts-8z29-pqcs",
    "summary": "Inefficient Regular Expression Complexity\nA vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some unknown functionality of the file packages/json-deserializer/src/JsonDeserializer.ts of the component JSON Mime-Type Handler. The manipulation leads to inefficient regular expression complexity. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as f689404d830cbc1edd6a1018d3334ff5f44dc6a6. It is recommended to upgrade the affected component. VDB-253406 is the identifier assigned to this vulnerability.",
    "aliases": [
        {
            "alias": "CVE-2021-4437"
        },
        {
            "alias": "GHSA-m3f4-957x-m785"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/68878?format=api",
            "purl": "pkg:npm/%40lambda-middleware/json-deserializer@1.1.0",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540lambda-middleware/json-deserializer@1.1.0"
        }
    ],
    "affected_packages": [],
    "references": [
        {
            "reference_url": "https://github.com/dbartholomae/lambda-middleware/commit/f689404d830cbc1edd6a1018d3334ff5f44dc6a6",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/dbartholomae/lambda-middleware/commit/f689404d830cbc1edd6a1018d3334ff5f44dc6a6"
        },
        {
            "reference_url": "https://github.com/dbartholomae/lambda-middleware/pull/57",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/dbartholomae/lambda-middleware/pull/57"
        },
        {
            "reference_url": "https://github.com/dbartholomae/lambda-middleware/releases/tag/@lambda-middleware/frameguard_v1.1.0",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/dbartholomae/lambda-middleware/releases/tag/@lambda-middleware/frameguard_v1.1.0"
        },
        {
            "reference_url": "https://vuldb.com/?ctiid.253406",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://vuldb.com/?ctiid.253406"
        },
        {
            "reference_url": "https://vuldb.com/?id.253406",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://vuldb.com/?id.253406"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4437",
            "reference_id": "CVE-2021-4437",
            "reference_type": "",
            "scores": [],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4437"
        },
        {
            "reference_url": "https://github.com/advisories/GHSA-m3f4-957x-m785",
            "reference_id": "GHSA-m3f4-957x-m785",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/advisories/GHSA-m3f4-957x-m785"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        },
        {
            "cwe_id": 1333,
            "name": "Inefficient Regular Expression Complexity",
            "description": "The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        }
    ],
    "exploits": [],
    "severity_range_score": null,
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ucts-8z29-pqcs"
}