Description
Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected products
- RocketChat / Rocket.Chat< 3.11.3 – < 3.11.3
References
- MISChttps://docs.rocket.chat/guides/security/security-updates
- VENDOR_ADVISORYhttps://securitylab.github.com/advisories/GHSL-2020-310-redos-Rocket.Chat/
- PATCHhttps://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3
- PATCHhttps://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094c