Описание
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.
A flaw was found in npm-prismjs. An attacker can craft a string that will take a very long time to highlight when used to work with un-trusted text resulting in ReDoS.
This can affect the system availability. There is no known risk of privilege escalation on data compromise.
Отчет
In OpenShift Container Platform (OCP) the affected grafana container is behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-prismjs library to authenticated users only, therefore the impact is low. Additionally, OCP 3.11 and OpenShift Service Mesh 1.1.x are in maintenance support for low and moderate impact vulnerabilities, hence the OCP 3.11 and OSSM 1.1 grafana containers have been set OOSS.
Меры по смягчению последствий
As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Service Mesh 1 | servicemesh-grafana | Out of support scope | ||
| OpenShift Service Mesh 2.0 | servicemesh-grafana | Affected | ||
| Red Hat Advanced Cluster Security 3 | rox | Affected | ||
| Red Hat Ceph Storage 3 | grafana | Out of support scope | ||
| Red Hat Ceph Storage 4 | rhceph/rhceph-4-dashboard-rhel8 | Not affected | ||
| Red Hat OpenShift Container Platform 3.11 | openshift3/grafana | Out of support scope | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-grafana | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.
Regular Expression Denial of Service (ReDoS) in Prism
Уязвимость инструмента выделения синтаксиса Prism, связанная с ошибками освобождения ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
6.5 Medium
CVSS3