ua-parser/uap-core

ua-parser/uap-core

Releases44

Frequency3 months 2 weeks

Last Release about 3 years ago

Stars819

The regex file necessary to build language ports of Browserscope's user agent parser.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2021-21317 ↗	Feb 16, 2021Tuesday, 16 February 2021, 18:15	5.3 MEDIUM	5 MEDIUM
uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.
CVE-2020-5243 ↗	Feb 21, 2020Friday, 21 February 2020, 00:15	5.7 MEDIUM	5 MEDIUM
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.
CVE-2018-20164 ↗	Feb 13, 2019Wednesday, 13 February 2019, 14:29	—	5 MEDIUM
An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)