CVE Vulnerabilities

CVE-2021-35065

Inefficient Regular Expression Complexity

Published: Dec 26, 2022 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

Weakness

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Affected Software

Name Vendor Start Version End Version
Glob-parent Gulpjs 6.0.0 (including) 6.0.1 (excluding)
Node-glob-parent Ubuntu bionic *
Node-glob-parent Ubuntu trusty *
Node-glob-parent Ubuntu upstream *
Node-glob-parent Ubuntu xenial *
MTA-6.0-RHEL-8 RedHat mta/mta-ui-rhel8:6.0.1-10 *
Red Hat Enterprise Linux 8 RedHat nodejs:16-8070020230314140722.bd1311ed *
Red Hat Enterprise Linux 8 RedHat nodejs:18-8070020230322080930.bd1311ed *
Red Hat Enterprise Linux 8 RedHat nodejs:14-8070020230306170042.bd1311ed *
Red Hat Enterprise Linux 8.4 Extended Update Support RedHat nodejs:14-8040020230306170312.522a0ee4 *
Red Hat Enterprise Linux 8.6 Extended Update Support RedHat nodejs:14-8060020230306170237.ad008a3a *
Red Hat Enterprise Linux 9 RedHat nodejs:18-9020020230327152102.rhel9 *
Red Hat Enterprise Linux 9 RedHat nodejs-1:16.19.1-1.el9_2 *
Red Hat Enterprise Linux 9 RedHat nodejs-nodemon-0:2.0.20-3.el9_2 *
Red Hat Single Sign-On 7 RedHat glob-parent *
Red Hat Single Sign-On 7.6 for RHEL 7 RedHat rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso *
Red Hat Single Sign-On 7.6 for RHEL 8 RedHat rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso *
Red Hat Single Sign-On 7.6 for RHEL 9 RedHat rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs14-nodejs-0:14.21.1-3.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7 *
RHEL-8 based Middleware Containers RedHat rh-sso-7/sso76-openshift-rhel8:7.6-20 *
RHOL-5.6-RHEL-8 RedHat openshift-logging/logging-view-plugin-rhel8:v5.6.1-8 *

Extended Description

	  Attackers can create crafted inputs that
	  intentionally cause the regular expression to use
	  excessive backtracking in a way that causes the CPU
	  consumption to spike.

Potential Mitigations

References