Incorrect Regular Expression in trim-newlines - CVE-2021-33623

Vulnerability identifier: #VU63709

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33623

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

trim-newlines
rhv-log-collector-analyzer (Red Hat package)
ovirt-engine-ui-extensions (Red Hat package)
ovirt-web-ui (Red Hat package)
ovirt-engine-dwh (Red Hat package)
ovirt-engine (Red Hat package)
rhvm-branding-rhv (Red Hat package)
node-trim-newlines (Ubuntu package)
apache-commons-compress (Red Hat package)
ovirt-log-collector (Red Hat package)
ovirt-dependencies (Red Hat package)
postgresql-jdbc (Red Hat package)
IBM Edge Application Manager
Red Hat Virtualization Manager
Ubuntu
IBM Cloud Pak System
QRadar Deployment Intelligence App

Install update from vendor's website.

trim-newlines - addressed in versions 3.0.1, 4.0.1
rhv-log-collector-analyzer (Red Hat package) - update to 1.0.14-1.el8ev
ovirt-engine-ui-extensions (Red Hat package) - update to 1.3.4-1.el8ev
ovirt-web-ui (Red Hat package) - update to 1.9.0-1.el8ev
ovirt-engine-dwh (Red Hat package) - update to 4.5.3-1.el8ev
ovirt-engine (Red Hat package) - update to 4.5.1.2-0.11.el8ev
rhvm-branding-rhv (Red Hat package) - update to 4.5.0-1.el8ev
node-trim-newlines (Ubuntu package) - addressed in versions 1.0.0-1ubuntu0.18.04.1, 1.0.0-1ubuntu0.20.04.1
apache-commons-compress (Red Hat package) - update to 1.21-1.2.el8ev
IBM Cloud Pak System - update to 2.3.3.5
QRadar Deployment Intelligence App - update to 3.0.5
ovirt-log-collector (Red Hat package) - update to 4.4.6-1.el8ev
ovirt-dependencies (Red Hat package) - update to 4.5.2-1.el8ev
postgresql-jdbc (Red Hat package) - update to 42.2.14-1.el8ev

• https://www.npmjs.com/package/trim-newlines
• https://github.com/sindresorhus/trim-newlines/releases/tag/v4.0.1
• https://security.netapp.com/advisory/ntap-20210702-0007/

• Multiple vulnerabilities in Red Hat Virtualization Manager
• Ubuntu update for node-trim-newlines
• IBM Edge Application Manager update for trim-newlines
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App