Incorrect Regular Expression in terser - CVE-2022-25858

Vulnerability identifier: #VU67974

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-25858

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

terser
Cloud Pak for Security (CP4S)
OpenShift Service Mesh
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Integration - Service Registry
QRadar User Behavior Analytics
DB2 Data Management Console
Data Virtualization (DV) on Cloud Pak for Data (CPD)
IBM Edge Application Manager
IBM Cloud Pak System

Install update from vendor's website.

terser - addressed in versions 4.8.1, 5.14.2
Cloud Pak for Security (CP4S) - update to 1.10.13.0
OpenShift Service Mesh - update to 2.2.7
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.4.8, 2.6.2
DB2 Data Management Console - update to 3.1.13.2
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 1.8.0
Red Hat Integration - Service Registry - update to 2.3.0
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
QRadar User Behavior Analytics - update to 4.1.13

• https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722
• https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012
• https://snyk.io/vuln/SNYK-JS-TERSER-2806366
• https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135

• Denial of service in terser
• Multiple vulnerabilities in Red Hat Integration - Service registry
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.6
• Incorrect Regular Expression in IBM Edge Application Manager
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.2
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Data Virtualization on Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM DB2 Data Management Console