Incorrect Regular Expression in loader-utils - CVE-2022-37599

Vulnerability identifier: #VU70122

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-37599

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input passed via the resourcePath variable to  interpolateName() function in interpolateName.js. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

loader-utils
IBM Engineering Requirements Quality Assistant
DB2 Data Management Console
IBM Business Automation Manager Open Editions
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Storage Fusion Data Foundation
Cloud Pak for Security (CP4S)
IBM Process Mining
Jira Service Management Data Center
Confluence Data Center
Jira Software Data Center
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Cloud Pak for Multicloud Management Security Services
IBM Fusion HCI
QRadar User Behavior Analytics
IBM Edge Application Manager
Splunk Enterprise Security (ES)
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Splunk Enterprise
Confluence Server
Fedora
yarnpkg

Install update from vendor's website.

loader-utils - addressed in versions 1.4.2, 2.0.4, 3.2.1
Cloud Pak for Security (CP4S) - update to 1.10.15.0
IBM Process Mining - update to 2.0
DB2 Data Management Console - update to 3.1.13.2
Splunk Enterprise Security (ES) - addressed in versions 7.1.2, 7.2.0, 7.3.0
Jira Service Management Data Center - update to 10.3.23
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.4
IBM Business Automation Manager Open Editions - update to 8.0.4
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
Confluence Server - addressed in versions 9.2.1, 9.4.0, 9.5.1, 10.0.2
Confluence Data Center - addressed in versions 9.2.1, 9.4.0, 9.5.1, 10.0.2
Jira Software Data Center - update to 10.3.22
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-4
yarnpkg - addressed in versions 1.22.21-2.fc38, 1.22.21-2.fc39
IBM Cloud Pak for Multicloud Management Security Services - update to 2.3 Fix Pack 6
IBM Fusion HCI - update to 2.6.1
QRadar User Behavior Analytics - update to 4.1.11
DB2 Warehouse on Cloud Pak for Data - update to 4.6.2
DB2 on Cloud Pak for Data - update to 4.6.2
Storage Fusion Data Foundation - update to 4.18.2

• https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38
• https://github.com/webpack/loader-utils/issues/211
• https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83
• https://github.com/webpack/loader-utils/issues/216
• https://github.com/advisories/GHSA-hhq3-ff78-jv3g

• Multiple vulnerabilities in webpack loader-utils
• Incorrect regular expression in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Edge Application Manager
• Incorrect Regular Expression in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Engineering Requirements Quality Assistant On-Premises
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in IBM Storage Fusion and IBM Storage Fusion HCI
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Splunk Enterprise Security (ES) update for third-party components
• Fedora 38 update for yarnpkg
• Fedora 39 update for yarnpkg
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Security Services
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Storage Fusion Data Foundation
• Confluence Data Center and Server for webpack loader-utils
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center