Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Regular Expression Denial of Service (ReDoS) in Prism
Vulnerability Description
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Vulnerability Title
Prism 资源管理错误漏洞
Vulnerability Description
Prism是美国Prism个人开发者的一个应用软件。是一种轻量级的，可扩展的语法突出显示工具。 Prism 1.24.0之前版本存在安全漏洞，该漏洞源于当Prism用于突出显示不受信任的文本时，攻击者可利用该漏洞精心制作一个字符串，需要非常非常长的时间来显示。
CVSS Information
N/A
Vulnerability Type
N/A