Incorrect Regular Expression in glob-parent - CVE-2020-28469

Vulnerability identifier: #VU52985

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28469

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect handling of user-supplied input in regular expression. A remote attacker can pass specially crafted input to the application and perform regular expression denial of service (ReDoS) attack.

glob-parent
QRadar Pulse App
rhv-log-collector-analyzer (Red Hat package)
ovirt-engine-extension-aaa-ldap (Red Hat package)
ovirt-web-ui (Red Hat package)
ovirt-engine-dwh (Red Hat package)
ovirt-engine (Red Hat package)
rhvm-branding-rhv (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
ovirt-engine-ui-extensions (Red Hat package)
ovirt-engine-metrics (Red Hat package)
rh-nodejs14-nodejs-nodemon (Red Hat package)
rh-nodejs12-nodejs-nodemon (Red Hat package)
nodejs-nodemon
nodejs-nodemon (Red Hat package)
npm
rh-nodejs12-nodejs (Red Hat package)
rh-nodejs14-nodejs (Red Hat package)
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-docs
nodejs (Red Hat package)
nodejs-packaging
Cloud Pak for Security (CP4S)
IBM QRadar Data Synchronization App
Oracle Communications Cloud Native Core Policy
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Transformation Advisor
IBM Cloud Automation Manager
Jira Service Management Data Center
Crowd Data Center
Confluence Data Center
Jira Software Data Center
IBM Watson Machine Learning Accelerator
Storage Defender – Data Protect
IBM Edge Application Manager
Red Hat Virtualization Manager
Crowd Server
Confluence Server
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Oracle Linux
Splunk Enterprise
IBM Security QRadar Analyst Workflow
Contrail Networking

Install updates from vendor's website.

glob-parent - update to 5.1.2
QRadar Pulse App - update to 2.2.9
rhv-log-collector-analyzer (Red Hat package) - addressed in versions 1.0.10-1.el8ev, 1.0.11-1.el8ev
ovirt-engine-extension-aaa-ldap (Red Hat package) - addressed in versions 1.4.4-1.el8ev, 1.4.5-1.el8ev
ovirt-web-ui (Red Hat package) - addressed in versions 1.7.0-1.el8ev, 1.7.2-1.el8ev
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Red Hat Advanced Cluster Management for Kubernetes - update to 2.2.3
ovirt-engine-dwh (Red Hat package) - addressed in versions 4.4.7.3-1.el8ev, 4.4.9.1-1.el8ev
ovirt-engine (Red Hat package) - addressed in versions 4.4.7.6-0.11.el8ev, 4.4.9.2-0.6.el8ev
rhvm-branding-rhv (Red Hat package) - update to 4.4.9-1.el8ev
Jira Service Management Data Center - addressed in versions 10.3.18, 11.3.0
Crowd Server - update to 7.1.4
Crowd Data Center - update to 7.1.4
Confluence Data Center - addressed in versions 9.2.13, 10.2.2
Confluence Server - addressed in versions 9.2.13, 10.2.2
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
Jira Software Data Center - addressed in versions 10.3.18, 11.3.0
Contrail Networking - update to R22.3
ovirt-engine-ui-extensions (Red Hat package) - update to 1.2.7-1.el8ev
ovirt-engine-metrics (Red Hat package) - update to 1.4.4-1.el8ev
Storage Defender – Data Protect - update to 2.0.1
rh-nodejs14-nodejs-nodemon (Red Hat package) - update to 2.0.3-5.el7
rh-nodejs12-nodejs-nodemon (Red Hat package) - update to 2.0.3-5.el7
nodejs-nodemon - update to 2.0.15-1
nodejs-nodemon (Red Hat package) - update to 2.0.19-1.el9_0
IBM Security QRadar Analyst Workflow - update to 2.15.1
IBM QRadar Data Synchronization App - update to 3.0.1
npm - addressed in versions 6.14.15-1.14.18.2.2, 8.1.2-1.16.13.1.3
rh-nodejs12-nodejs (Red Hat package) - update to 12.22.5-1.el7
rh-nodejs14-nodejs (Red Hat package) - update to 14.17.5-1.el7
nodejs - addressed in versions 14.18.2-2, 16.13.1-3
nodejs-devel - addressed in versions 14.18.2-2, 16.13.1-3
nodejs-full-i18n - addressed in versions 14.18.2-2, 16.13.1-3
nodejs-docs - addressed in versions 14.18.2-2, 16.13.1-3
nodejs (Red Hat package) - update to 16.16.0-1.el9_0
nodejs-packaging - addressed in versions 23-3, 25-1

• https://bugzilla.redhat.com/show_bug.cgi?id=1945459
• https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905

• Denial of service in gulp glob-parent
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Multiple vulnerabilities in Red Hat Virtualization Manager
• Multiple vulnerabilities in Red Hat Virtualization Manager
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Red Hat Enterprise Linux 9 update for nodejs and nodejs-nodemon
• Multiple vulnerabilities in Juniper Networks Contrail Networking
• Multiple vulnerabilities in IBM QRadar Pulse for QRadar SIEM
• Multiple vulnerabilities in Oracle Linux
• Red Hat Software Collections update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon
• Red Hat Software Collections update for rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon
• Multiple vulnerabilities in IBM Edge Application Manager
• Incorrect Regular Expression in IBM Cloud Automation Manager
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Storage Defender - Data Protect
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Red Hat Enterprise Linux 8 update for the nodejs:16 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Anolis OS update for nodejs:16 module
• Anolis OS update for nodejs:14 module
• Crowd Data Center and Server update for glob-parent
• Confluence Data Center and Server update for glob-parent
• Jira Service Management Data Center update for glob-parent
• Jira Software Data Center update for glob-parent