Incorrect Regular Expression in loader-utils - CVE-2022-37603

Vulnerability identifier: #VU70121

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-37603

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing URL within the interpolateName() function in interpolateName.js. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

loader-utils
Migration Toolkit for Runtimes
IBM Process Mining
OpenShift Logging
Jira Service Management Data Center
Red Hat Migration Toolkit for Applications
Confluence Data Center
Jira Software Data Center
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Fusion HCI
QRadar User Behavior Analytics
App Connect Enterprise Certified Container
IBM Maximo Application Suite
Migration Toolkit for Containers
IBM Cloud Pak for Multicloud Management
IBM Edge Application Manager
Cloud Pak for Security (CP4S)
JBoss Data Grid
Splunk Enterprise Security (ES)
Red Hat Single Sign-On
Splunk Enterprise
Confluence Server
Fedora
yarnpkg
rh-sso7-keycloak (Red Hat package)
Cloud Pak for Network Automation
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Storage Fusion Data Foundation
IBM QRadar Use Case Manager

Install update from vendor's website.

loader-utils - addressed in versions 1.4.2, 2.0.4, 3.2.1
Migration Toolkit for Runtimes - update to 1.0.1
Migration Toolkit for Containers - update to 1.7.8
Cloud Pak for Security (CP4S) - update to 1.10.15.0
IBM Process Mining - update to 2.0
IBM Cloud Pak for Multicloud Management - update to 2.3.8
Splunk Enterprise Security (ES) - addressed in versions 7.1.2, 7.2.0, 7.3.0
OpenShift Logging - update to 5.5.5
Jira Service Management Data Center - update to 10.3.23
Red Hat Migration Toolkit for Applications - update to 6.0.1
Red Hat Single Sign-On - update to 7.6.2
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
JBoss Data Grid - update to 8.4.1
Confluence Server - addressed in versions 9.2.1, 9.4.0, 9.5.1, 10.0.2
Confluence Data Center - addressed in versions 9.2.1, 9.4.0, 9.5.1, 10.0.2
Jira Software Data Center - update to 10.3.22
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-4
yarnpkg - addressed in versions 1.22.19-5.fc36, 1.22.19-5.fc37, 1.22.19-5.fc38
Cloud Pak for Network Automation - update to 2.4.3
IBM Fusion HCI - update to 2.6.1
IBM QRadar Use Case Manager - update to 3.8.0
QRadar User Behavior Analytics - update to 4.1.11
DB2 on Cloud Pak for Data - update to 4.6.2
DB2 Warehouse on Cloud Pak for Data - update to 4.6.2
Storage Fusion Data Foundation - update to 4.18.2
App Connect Enterprise Certified Container - addressed in versions 5.0.2, 6.2.0
IBM Maximo Application Suite - addressed in versions 8.9.3, 8.10.0
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso

• https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38
• https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107
• https://github.com/webpack/loader-utils/issues/213
• https://github.com/advisories/GHSA-3rfm-jhwj-7488

• Multiple vulnerabilities in webpack loader-utils
• Multiple vulnerabilities in OpenShift Logging 5.5
• Incorrect regular expression in IBM Cloud Pak for Integration
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Incorrect regular expression in IBM App Connect Enterprise Certified Container
• Incorrect regular expression in IBM Maximo Application Suite - Monitor Component
• Incorrect Regular Expression in IBM Edge Application Manager
• Fedora 36 update for yarnpkg
• Fedora 38 update for yarnpkg
• Fedora 37 update for yarnpkg
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Storage Fusion and IBM Storage Fusion HCI
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM QRadar Use Case Manager
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Splunk Enterprise Security (ES) update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Storage Fusion Data Foundation
• Confluence Data Center and Server update for loader-utils
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center