ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Weakness
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ansi-regex | Ansi-regex_project | 4.0.0 (including) | 4.1.1 (excluding) |
| Ansi-regex | Ansi-regex_project | 3.0.0 (including) | 3.0.0 (including) |
| Ansi-regex | Ansi-regex_project | 5.0.0 (including) | 5.0.0 (including) |
| Ansi-regex | Ansi-regex_project | 6.0.0 (including) | 6.0.0 (including) |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:16-8050020211206113934.c5368500 | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:14-8050020211213115342.c5368500 | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:16-8060020220805104227.ad008a3a | * |
| Red Hat Enterprise Linux 8.4 Extended Update Support | RedHat | nodejs:14-8040020211213111158.522a0ee4 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs-nodemon-0:2.0.19-1.el9_0 | * |
| Red Hat Fuse 7.11 | RedHat | io.hawt-hawtio-online | * |
| Red Hat Fuse 7.11 | RedHat | io.hawt-project | * |
| Red Hat Migration Toolkit for Containers 1.6 | RedHat | rhmtc/openshift-migration-ui-rhel8:v1.6.5-8 | * |
| Red Hat Migration Toolkit for Containers 1.7 | RedHat | rhmtc/openshift-migration-ui-rhel8:v1.7.2-9 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-0:14.18.2-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7 | * |
| Red Hat Virtualization Engine 4.4 | RedHat | ovirt-engine-ui-extensions-0:1.3.3-1.el8ev | * |
| Red Hat Virtualization Engine 4.4 | RedHat | ovirt-web-ui-0:1.9.0-1.el8ev | * |
| RHODF-4.13-RHEL-9 | RedHat | odf4/mcg-core-rhel9:v4.13.0-41 | * |
| Node-ansi-regex | Ubuntu | bionic | * |
| Node-ansi-regex | Ubuntu | focal | * |
| Node-ansi-regex | Ubuntu | hirsute | * |
| Node-ansi-regex | Ubuntu | impish | * |
| Node-ansi-regex | Ubuntu | kinetic | * |
| Node-ansi-regex | Ubuntu | lunar | * |
| Node-ansi-regex | Ubuntu | mantic | * |
| Node-ansi-regex | Ubuntu | oracular | * |
| Node-ansi-regex | Ubuntu | plucky | * |
| Node-ansi-regex | Ubuntu | trusty | * |
| Node-ansi-regex | Ubuntu | xenial | * |
Extended Description
Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.
Potential Mitigations
Related Attack Patterns
References
- https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9
- https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
- https://security.netapp.com/advisory/ntap-20221014-0002/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9
- https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
- https://security.netapp.com/advisory/ntap-20221014-0002/
- https://www.oracle.com/security-alerts/cpuapr2022.html