uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or
    not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression
    is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is
    trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to
    `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and
    earlier. (CVE-2017-16021)

Update to latest nodejs-uri-js for CVE fix

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422754	SCA: security update for uri-js (GHSA-333w-rxj3-f55r)	Tenable Cloud Security	SCA Checks	medium
422754	SCA: security update for uri-js (GHSA-333w-rxj3-f55r)	Tenable Self-Hosted Container Security	SCA Checks	medium
120349	Fedora 28 : nodejs-JSV / nodejs-uri-js (2018-373bbbd408)	Nessus	Fedora Local Security Checks	medium
110574	Fedora 27 : nodejs-JSV / nodejs-uri-js (2018-13e08f4b4a)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-16021

medium

Tenable Plugins

medium

medium

medium

medium