Resource exhaustion in axios - CVE-2021-3749

Vulnerability identifier: #VU56963

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3749

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a regular expression denial of service (ReDoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the isURLSearchParams function in utils.js. A remote attacker can send specially crafted data to the application and perform regular expression denial of service (ReDoS) attack.

axios
Migration Toolkit for Containers
IBM Watson Discovery for IBM Cloud Pak for Data
Red Hat Advanced Cluster Security for Kubernetes
SINEC INS
IBM i Modernization Engine for Lifecycle Integration
IBM Cloud Pak System
Oracle GoldenGate

Install updates from vendor's website.

axios - update to 0.21.2
Migration Toolkit for Containers - update to 1.6.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-5, 4.0.3
SINEC INS - update to 1.0 SP2
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.7
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
Red Hat Advanced Cluster Security for Kubernetes - update to 3.67
Oracle GoldenGate - update to 21.7.0.0.0

• https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
• https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31

• Denial of service in axios
• Migration Toolkit for Containers (MTC) update for axios
• Uncontrolled Resource Consumption in IBM Watson Discovery
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in Oracle GoldenGate
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.67