Incorrect Regular Expression in hosted-git-info - CVE-2021-23362

Vulnerability identifier: #VU61255

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-23362

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expression "shortcutMatch" in the "fromUrl" function. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

hosted-git-info
Planning Analytics Local
Arch Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
openEuler
IBM Netcool Agile Service Manager
Rational Application Developer
QRadar User Behavior Analytics
IBM Cloud Automation Manager
Cloud Pak for Security (CP4S)
IBM QRadar Data Synchronization App
IBM Edge Application Manager
SINEC INS
nodejs-nodemon
rh-nodejs14-nodejs-nodemon (Red Hat package)
rh-nodejs12-nodejs-nodemon (Red Hat package)
nodejs-common
nodejs-hosted-git-info
npm
nodejs8-docs
nodejs8
nodejs8-debuginfo
nodejs8-debugsource
nodejs8-devel
npm8
nodejs10-debugsource
nodejs10-devel
npm10
nodejs10-docs
nodejs10-debuginfo
nodejs10
rh-nodejs12-nodejs (Red Hat package)
nodejs12
nodejs12-debuginfo
nodejs12-debugsource
nodejs12-docs
npm12
nodejs12-devel
nodejs-lts-erbium
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-docs
rh-nodejs14-nodejs (Red Hat package)
nodejs14
nodejs14-docs
npm14
nodejs14-debuginfo
nodejs14-debugsource
nodejs14-devel
nodejs-lts-fermium
nodejs-packaging

Install update from vendor's website.

hosted-git-info - update to 3.0.8
IBM Netcool Agile Service Manager - update to 1.1.13
Cloud Pak for Security (CP4S) - update to 1.8.0.0
SINEC INS - update to 1.0.1.1
nodejs-nodemon - addressed in versions 1.18.3-1, 2.0.3-1
rh-nodejs14-nodejs-nodemon (Red Hat package) - update to 2.0.3-2.el7
rh-nodejs12-nodejs-nodemon (Red Hat package) - update to 2.0.3-2.el7
nodejs-common - update to 2.0-3.2.1
nodejs-hosted-git-info - update to 2.1.4-2
IBM QRadar Data Synchronization App - update to 3.0.1
QRadar User Behavior Analytics - update to 4.1.11
IBM Cloud Automation Manager - update to 4.2.0.1 iFix 3
npm - addressed in versions 6.14.13-1.12.22.3.2, 6.14.13-1.14.17.3.2, 6.14.14-1.12.22.5.1
nodejs8-docs - addressed in versions 8.17.0-3.47.2, 8.17.0-10.12.2
nodejs8 - addressed in versions 8.17.0-3.47.2, 8.17.0-10.12.2
nodejs8-debuginfo - addressed in versions 8.17.0-3.47.2, 8.17.0-10.12.2
nodejs8-debugsource - addressed in versions 8.17.0-3.47.2, 8.17.0-10.12.2
nodejs8-devel - addressed in versions 8.17.0-3.47.2, 8.17.0-10.12.2
npm8 - addressed in versions 8.17.0-3.47.2, 8.17.0-10.12.2
nodejs10-debugsource - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
nodejs10-devel - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
npm10 - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
nodejs10-docs - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
nodejs10-debuginfo - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
nodejs10 - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
rh-nodejs12-nodejs (Red Hat package) - update to 12.22.2-1.el7
nodejs12 - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs12-debuginfo - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs12-debugsource - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs12-docs - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
npm12 - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs12-devel - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs-lts-erbium - update to 12.22.3-1
nodejs - addressed in versions 12.22.3-2, 12.22.5-1, 14.17.3-2
nodejs-devel - addressed in versions 12.22.3-2, 12.22.5-1, 14.17.3-2
nodejs-full-i18n - addressed in versions 12.22.3-2, 12.22.5-1, 14.17.3-2
nodejs-docs - addressed in versions 12.22.3-2, 12.22.5-1, 14.17.3-2
rh-nodejs14-nodejs (Red Hat package) - update to 14.17.2-1.el7
nodejs14 - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs14-docs - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
npm14 - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs14-debuginfo - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs14-debugsource - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs14-devel - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs-lts-fermium - update to 14.17.3-1
nodejs - update to 16.4.1-1
nodejs-packaging - addressed in versions 17-3, 23-3

• https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3
• https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356
• https://github.com/npm/hosted-git-info/commits/v2
• https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7
• https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01

• Denial of service in hosted-git-info package
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple Vulnerabilities in IBM Netcool Agile Service Manager
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• SUSE update for nodejs14
• SUSE update for nodejs10
• SUSE update for nodejs12
• SUSE update for nodejs12
• SUSE update for nodejs10
• SUSE update for nodejs14
• SUSE update for nodejs8
• SUSE update for nodejs8
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in Rational Application Developer for WebSphere Software
• Red Hat Software Collections update for rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon
• Red Hat Software Collections update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon
• Arch Linux update for nodejs
• Arch Linux update for nodejs-lts-erbium
• Arch Linux update for nodejs-lts-fermium
• IBM Cloud Automation Manager update for hosted-git-info
• Incorrect Regular Expression in IBM Edge Application Manager
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• openEuler 20.03 LTS SP1 update for nodejs-hosted-git-info
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Anolis OS update for nodejs:14 module
• Anolis OS update for nodejs:12 (Anolis OS 8.4) module
• Anolis OS update for nodejs:12 (Anolis OS 8.2) module