Описание
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive processor and memory consumption that can temporarily block the application event loop.
Отчет
A moderate-impact denial of service vulnerability was found in brace-expansion, an npm package bundled as a dependency in a large number of Red Hat products that ship Node.js-based components. When an application passes attacker-controlled input to the expand function, a remote unauthenticated attacker can supply a crafted {a},b}-shaped pattern containing many trailing closing braces. The parser rewrites the string and restarts its scan once for each trailing closing brace, and every pass rescans the entire input, resulting in quadratic CPU time and memory consumption. This can block the Node.js event loop of the affected process and temporarily disrupt application availability; the process recovers once the expansion completes, making this a recoverable CPU denial of service with no impact on confidentiality or integrity. The large majority of Red Hat product streams that ship a bundled copy of brace-expansion are affected; a small number of shipped components are marked not affected because the vulnerable code is not present in the shipped version or because those components do not include brace-expansion. For most affected streams the fix is deferred to a routine future component update, since the flaw is a recoverable, availability-only denial of service of low severity; the residual risk of deferral is temporary CPU and memory pressure and event-loop blocking when an attacker is able to supply crafted brace patterns to an affected application's expansion call. For streams where remediation is delegated, the maintainers of the bundled component are pursuing a fix, and a small number of streams have already shipped an update that remediates the issue. The Red Hat severity of MODERATE (CVSS 3.1 score 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is consistent with the upstream assessment, so there is no meaningful difference from upstream severity.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating the bundled brace-expansion dependency to a version that contains the upstream fix (1.1.21, 2.1.7, 3.0.9, or 5.0.12, depending on the major version in use) resolves the issue.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cost Management On Premise | costmanagement/costmanagement-ui-rhel10 | Fix deferred | ||
| Cryostat 4 | cryostat/cryostat-openshift-console-plugin-rhel9 | Fix deferred | ||
| Exploit Intelligence | exploit-intelligence/vulnerability-analysis-rhel9 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-nodejs-external-provider-rhel9 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel9 | Fix deferred | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Fix deferred | ||
| Node HealthCheck Operator | workload-availability/node-healthcheck-must-gather-rhel9 | Fix deferred | ||
| Node HealthCheck Operator | workload-availability/node-healthcheck-operator-bundle | Fix deferred | ||
| Node HealthCheck Operator | workload-availability/node-healthcheck-rhel9-operator | Fix deferred | ||
| Node HealthCheck Operator | workload-availability/node-remediation-console-rhel8 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
The brace-expansion library generates arbitrary strings containing a c ...
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
EPSS
5.3 Medium
CVSS3