From 4f04aaad60a2837b0a730c793abb8a5e3e7c947b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 24 Oct 2024 19:02:25 +0000 Subject: [PATCH] Publish Advisories GHSA-5j4c-8p2g-v4jx GHSA-jmrf-85g8-x8xv GHSA-5j4c-8p2g-v4jx GHSA-jmrf-85g8-x8xv --- .../GHSA-5j4c-8p2g-v4jx.json | 65 ++++++++++++++++ .../GHSA-jmrf-85g8-x8xv.json | 74 +++++++++++++++++++ .../GHSA-5j4c-8p2g-v4jx.json | 38 ---------- .../GHSA-jmrf-85g8-x8xv.json | 35 --------- 4 files changed, 139 insertions(+), 73 deletions(-) create mode 100644 advisories/github-reviewed/2024/10/GHSA-5j4c-8p2g-v4jx/GHSA-5j4c-8p2g-v4jx.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-jmrf-85g8-x8xv/GHSA-jmrf-85g8-x8xv.json delete mode 100644 advisories/unreviewed/2024/10/GHSA-5j4c-8p2g-v4jx/GHSA-5j4c-8p2g-v4jx.json delete mode 100644 advisories/unreviewed/2024/10/GHSA-jmrf-85g8-x8xv/GHSA-jmrf-85g8-x8xv.json diff --git a/advisories/github-reviewed/2024/10/GHSA-5j4c-8p2g-v4jx/GHSA-5j4c-8p2g-v4jx.json b/advisories/github-reviewed/2024/10/GHSA-5j4c-8p2g-v4jx/GHSA-5j4c-8p2g-v4jx.json new file mode 100644 index 00000000000..413f78d85e4 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-5j4c-8p2g-v4jx/GHSA-5j4c-8p2g-v4jx.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5j4c-8p2g-v4jx", + "modified": "2024-10-24T18:42:59Z", + "published": "2024-10-15T18:30:50Z", + "aliases": [ + "CVE-2024-9506" + ], + "summary": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function", + "details": "The ReDoS can be exploited through the `parseHTML` function in the `html-parser.ts` file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.\n\nTo demonstrate this vulnerability, here's an example. In a Vue client-side application, create a new Vue instance with a template string that includes a `