Infinite loop in nanoid - CVE-2024-55565

Vulnerability identifier: #VU102463

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-55565

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop. A remote user can consume all available system resources and cause denial of service conditions.

nanoid
IBM Security QRadar Log Management AQL Plugin
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
App Connect Enterprise Certified Container
IBM Automation Decision Services
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Cloud Pak for Security
IBM Process Mining
Ansible Automation Platform
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift Dev Spaces
IBM Watson Discovery for IBM Cloud Pak for Data
OpenShift Logging
IBM Maximo Application Suite
Software Support app (Android)
Cloud Pak for Network Automation
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Business Automation Insights
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
QRadar Log Source Management App
Db2 Big SQL
IBM Event Endpoint Management
Splunk Machine Learning Toolkit
Fedora
python3.11-galaxy-importer (Red Hat package)
python3.11-yarl (Red Hat package)
python3.11-aiohappyeyeballs (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
automation-gateway (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
ansible-core (Red Hat package)
python3.11-aiodns (Red Hat package)
python3.11-aiohttp (Red Hat package)
qgis
python3.11-pulpcore (Red Hat package)
python-nbdime
jupyterlab
automation-controller (Red Hat package)
phpMyAdmin
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
OpenShift Service Mesh
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Security QRadar Analyst Workflow

Install updates from vendor's website.

nanoid - addressed in versions 3.3.8, 5.0.9
IBM Security QRadar Log Management AQL Plugin - update to 1.1.3
Software Support app (Android) - update to 2.0.2
IBM Fusion HCI - update to 2.10.0
Cloud Pak for Network Automation - update to 2.7.8
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Knowledge Catalog Premium Cartridge - update to 5.2
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
Splunk Machine Learning Toolkit - update to 5.6.0
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.27, 8.7.21, 9.0.14
App Connect Enterprise Certified Container - update to 12.9.0
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Automation Decision Services - update to 24.0.0.0.4
IBM Business Automation Workflow - addressed in versions 24.0.0-IF005, 24.0.1-IF002
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
python3.11-galaxy-importer (Red Hat package) - addressed in versions 0.4.27-1.el8ap, 0.4.27-1.el9ap
IBM Cloud Pak for Security - update to 1.11.2.0
python3.11-yarl (Red Hat package) - addressed in versions 1.13.1-1.el8ap, 1.13.1-1.el9ap
IBM Process Mining - update to 2.0.0 IF001
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
python3.11-aiohappyeyeballs (Red Hat package) - addressed in versions 2.4.4-1.el8ap, 2.4.4-1.el9ap
Ansible Automation Platform - update to 2.5
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.5-7.el8ap, 2.5-7.el9ap
OpenShift Service Mesh - update to 2.5.8
automation-gateway (Red Hat package) - addressed in versions 2.5.20250115-1.el8ap, 2.5.20250115-1.el9ap
python3.11-django-ansible-base (Red Hat package) - addressed in versions 2.5.20250115-1.el8ap, 2.5.20250115-1.el9ap
Multicluster Engine for Kubernetes - addressed in versions 2.6.5, 2.7.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.11.5, 2.12.2
ansible-core (Red Hat package) - addressed in versions 2.16.14-2.el8ap, 2.16.14-2.el9ap
IBM Security QRadar Analyst Workflow - update to 2.34.0
python3.11-aiodns (Red Hat package) - addressed in versions 3.2.0-1.el8ap, 3.2.0-1.el9ap
python3.11-aiohttp (Red Hat package) - addressed in versions 3.10.11-1.el8ap, 3.10.11-1.el9ap
Red Hat OpenShift Dev Spaces - update to 3.18.0
qgis - addressed in versions 3.40.5-2.fc41, 3.42.1-2.fc42
python3.11-pulpcore (Red Hat package) - addressed in versions 3.49.29-1.el8ap, 3.49.29-1.el9ap
python-nbdime - addressed in versions 4.0.2-2.fc40, 4.0.2-2.fc41
jupyterlab - addressed in versions 4.3.3-1.fc40, 4.3.3-1.fc41
automation-controller (Red Hat package) - addressed in versions 4.6.6-1.el8ap, 4.6.6-1.el9ap
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.16.5, 4.17.2, 4.18.0
Red Hat OpenShift Container Platform - addressed in versions 4.17.14, 4.17.15
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.1.2
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
watsonx Assistant Cartridge - update to 5.1.3
phpMyAdmin - addressed in versions 5.2.2-1.fc40, 5.2.2-1.fc41
OpenShift Logging - update to 5.9.10
QRadar Log Source Management App - update to 7.0.11
Db2 Big SQL - update to 7.8
IBM Maximo Application Suite - addressed in versions 8.10.21, 8.11.18, 9.0.7
IBM Event Endpoint Management - update to 11.4.2

• https://github.com/ai/nanoid/compare/3.3.7...3.3.8
• https://github.com/ai/nanoid/pull/510
• https://github.com/ai/nanoid/releases/tag/5.0.9
• https://github.com/advisories/GHSA-mwcw-c2x4-8c55

• Denial of service in NanoID
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Fedora 41 update for python-nbdime
• Fedora 40 update for python-nbdime
• Fedora 40 update for jupyterlab
• Fedora 41 update for jupyterlab
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• Multiple vulnerabilities in OpenShift Logging 5.9
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.18
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM Event Endpoint Management
• IBM Watson Discovery for IBM Cloud Pak for Data update for nanoid (aka Nano ID)
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.18
• IBM App Connect Enterprise Certified Container update for nanoid (aka Nano ID)
• Fedora 41 update for qgis
• Fedora 42 update for qgis
• Multiple vulnerabilities in IBM Software Support app (Android)
• IBM Maximo Application Suite update for nanoid
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Fedora 41 update for phpMyAdmin
• Fedora 40 update for phpMyAdmin
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Business Automation Workflow
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for nanoid
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Fusion
• Splunk Machine Learning Toolkit update for third-party components
• IBM Maximo Application Suite - Manage Component update for nanoid
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for nanoid
• Multiple vulnerabilities in IBM Automation Decision Services
• IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component update for nanoid
• Multiple vulnerabilities in IBM Security QRadar Log Management AQL Plugin
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM Big SQL on Cloud Pak for Data update for nanoid
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge