Inefficient regular expression complexity in path-to-regexp - CVE-2024-52798

Vulnerability identifier: #VU101895

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-52798

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
path-to-regexp
watsonx.data
Support for Hyperledger Fabric
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
Cloud Pak for Network Automation
Security QRadar EDR
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Watson Studio on Cloud Pak for Data
IBM OpenPages with Watson
Maximo Application Suite - IoT Component
Maximo Application Suite Ai Service
Business Automation Insights
QRadar Deployment Intelligence App
Application Modernization Accelerator
Cognos Dashboards on Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
Telco Service Orchestrator
QRadar Log Source Management App
IBM Decision Optimization for Cloud Pak for Data
Netcool Operations Insight
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite - AI Broker
IBM Spectrum Protect Plus
IBM Business Automation Workflow
IBM Cloud Pak for Security
Qradar Advisor
APEX Cloud Platform for Red Hat OpenShift
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Cloud Pak for Business Automation
IBM Cloud Pak System
IBM Edge Application Manager
Red Hat OpenShift Container Platform
IBM License Metric Tool
IBM QRadar Data Synchronization App
IBM Cognos Controller
QRadar Pulse App
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
HPE Unified OSS Console (UOC)
IBM App Connect Enterprise

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Install updates from vendor's website.

• https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4
• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w