Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOTE: this is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input.
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-central-db-rhel8:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-collector-rhel8:4.5.3-2 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-collector-slim-rhel8:4.5.3-2 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-main-rhel8:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-operator-bundle:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-rhel8-operator:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-roxctl-rhel8:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-scanner-db-rhel8:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-scanner-db-slim-rhel8:4.5.3-2 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-scanner-rhel8:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-scanner-slim-rhel8:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-scanner-v4-db-rhel8:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.5 | RedHat | advanced-cluster-security/rhacs-scanner-v4-rhel8:4.5.3-3 | * |
| Red Hat Advanced Cluster Security 4.6 | RedHat | advanced-cluster-security/rhacs-main-rhel8:4.6.0-6 | * |
| Red Hat Trusted Profile Analyzer | RedHat | rhtpa-trustification-service-rhel9 | * |
| Node-async | Ubuntu | mantic | * |
Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.