Incorrect regular expression in scss-tokenizer - CVE-2022-25758
Published: May 16, 2023
Vulnerability identifier: #VU76180
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-25758
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions in loadAnnotation() function. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Affected software
scss-tokenizer
IBM Edge Application Manager
Data Virtualization (DV) on Cloud Pak for Data (CPD)
IBM Cloud Pak System
QRadar User Behavior Analytics
IBM Edge Application Manager
Data Virtualization (DV) on Cloud Pak for Data (CPD)
IBM Cloud Pak System
QRadar User Behavior Analytics
How to mitigate CVE-2022-25758
Install update from vendor's website.
scss-tokenizer - update to 0.4.3
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 1.8.0
IBM Cloud Pak System - update to 2.3.4.0
QRadar User Behavior Analytics - update to 4.1.11
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 1.8.0
IBM Cloud Pak System - update to 2.3.4.0
QRadar User Behavior Analytics - update to 4.1.11