Threat Investigation
Request a demo

CVE-2020-5243

Medium

Description

uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.

SeverityMedium
CVSS5.7
Exploit probability—
ProductUap-core
PublishedFeb 21, 2020
First seenFeb 21, 2020
Weakness typeCWE-20Improper input validation

How to fix

Update
  • uap-core_project uap-core0.7.3 or later
  • uap-core0.7.3 or later
  • user_agent_parser2.6.0 or later

Affected products

ProductAffected versionsFixed in
uap-core_project uap-corev < 0.7.30.7.3
uap-corenpmv < 0.7.30.7.3
user_agent_parserRubyGemsv < 2.6.02.6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.