CVE-2022-1929 - CVE House

Status published Medium CVE-2022-1929

Exponential ReDoS in devcert

5.9 CVSS

Vulnerability Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-1929

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Denys Vozniuk from JFrog Security Research

References

https://research.jfrog.com/vulnerabilities/devcert-redos-xray-211352/

Affected Vendor

devcert

View all reports →

Affected Software

devcert

Vulnerable Versions:

unspecified

Timeline

Official Publish: June 1st, 2022

Last Modified: September 16th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-1333

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

Impact

T1190 Exploit Public-Facing Application

Initial Access

T1496 Resource Hijacking