cronvel terminal-kit up to 2.1.7 redos

EntryHistoryDiffjsonxmlCTI

A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular expression complexity. Using CWE to declare the problem leads to CWE-1333. The weakness was published 01/07/2023 as a2e446cc3927b559d0281683feb9b821e83b758c. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2021-4306. The attack needs to be initiated within the local network. There are no technical details available. There is no exploit available. The current price for an exploit might be approx. USD $0-$5k at the moment. The MITRE ATT&CK project declares the attack technique as T1449.003. It is declared as not defined. As 0-day the estimated underground price was around $0-$5k. Upgrading to version 2.1.8 is able to address this issue. The updated version is ready for download at github.com. The name of the patch is a2e446cc3927b559d0281683feb9b821e83b758c. The bugfix is ready for download at github.com. It is recommended to upgrade the affected component. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	46

Field

vulnerability_cvss3_meta_tempscore	2
vulnerability_cvss3_meta_basescore	2
vulnerability_cvss3_cna_basescore	1
vulnerability_cvss3_nvd_basescore	1
vulnerability_cvss2_nvd_basescore	1

Commit Conf

90%	34
70%	25
50%	14

Approve Conf

90%	34
70%	25
80%	14

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
13608564	01/29/2023	VulD...	cvss3_cna_basescore	3.5	see CVSS documentation	01/29/2023	accepted	90
13608563	01/29/2023	VulD...	cvss3_nvd_basescore	7.5	nist.gov	01/29/2023	accepted	90
13608562	01/29/2023	VulD...	cvss2_nvd_basescore	2.3	nist.gov	01/29/2023	accepted	90
13608561	01/29/2023	VulD...	cvss3_meta_tempscore	4.8	see CVSS documentation	01/29/2023	accepted	90
13608560	01/29/2023	VulD...	cvss3_meta_basescore	4.8	see CVSS documentation	01/29/2023	accepted	90
13608559	01/29/2023	VulD...	cve_cna	VulDB	nvd.nist.gov	01/29/2023	accepted	70
13608558	01/29/2023	VulD...	cvss3_cna_a	L	nvd.nist.gov	01/29/2023	accepted	70
13608557	01/29/2023	VulD...	cvss3_cna_i	N	nvd.nist.gov	01/29/2023	accepted	70
13608556	01/29/2023	VulD...	cvss3_cna_c	N	nvd.nist.gov	01/29/2023	accepted	70
13608555	01/29/2023	VulD...	cvss3_cna_s	U	nvd.nist.gov	01/29/2023	accepted	70
13608554	01/29/2023	VulD...	cvss3_cna_ui	N	nvd.nist.gov	01/29/2023	accepted	70
13608553	01/29/2023	VulD...	cvss3_cna_pr	L	nvd.nist.gov	01/29/2023	accepted	70
13608552	01/29/2023	VulD...	cvss3_cna_ac	L	nvd.nist.gov	01/29/2023	accepted	70
13608551	01/29/2023	VulD...	cvss3_cna_av	A	nvd.nist.gov	01/29/2023	accepted	70
13608550	01/29/2023	VulD...	cvss2_nvd_ai	P	nvd.nist.gov	01/29/2023	accepted	70
13608549	01/29/2023	VulD...	cvss2_nvd_ii	N	nvd.nist.gov	01/29/2023	accepted	70
13608548	01/29/2023	VulD...	cvss2_nvd_ci	N	nvd.nist.gov	01/29/2023	accepted	70
13608547	01/29/2023	VulD...	cvss2_nvd_au	S	nvd.nist.gov	01/29/2023	accepted	70
13608546	01/29/2023	VulD...	cvss2_nvd_ac	M	nvd.nist.gov	01/29/2023	accepted	70
13608545	01/29/2023	VulD...	cvss2_nvd_av	A	nvd.nist.gov	01/29/2023	accepted	70