ua-parser-js version 0.7.13 represents a minor update to the popular JavaScript library designed for parsing user-agent strings. Comparing it to the previous stable version, 0.7.12, the core functionality remains the same, focusing on accurately identifying browsers, operating systems, devices, and their versions from user-agent data. Both versions are lightweight and licensed under a permissive (GPL-2.0 OR MIT) license, making them suitable for a wide range of projects.
The key difference lies in the development dependencies. Version 0.7.13 upgrades uglify-js from version 1.3.4 to ~2.7.5. This likely reflects an effort to leverage the latest minification techniques and potentially address any security vulnerabilities or performance issues present in the older version. While this change is primarily internal, developers might see improvements in the minified size of their final application when bundling ua-parser-js. Additionally, version 0.7.13 was released on "2017-06-22", approximately seven months after version 0.7.12 which was released on "2016-11-14". This suggests a period of refinement, potential bug fixes, and updates to the user-agent database to maintain accuracy in identifying newer browser and device versions. For developers, using the latest version ensures access to the most up-to-date parsing capabilities and potentially benefits from improved performance and security.
All the vulnerabilities related to the version 0.7.13 of the package
ua-parser-js Regular Expression Denial of Service vulnerability
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
Regular Expression Denial of Service in ua-parser-js
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
ReDoS Vulnerability in ua-parser-js version
A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js.
This vulnerability bypass the library's MAX_LENGTH input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.
All versions of the library prior to version 0.7.33 / 1.0.33.
A patch has been released to remove the vulnerable regular expression, update to version 0.7.33 / 1.0.33 or later.
Regular expression Denial of Service - ReDoS
Thanks to @Snyk who first reported the issue.
