Incorrect Regular Expression in Npm-user-validate - CVE-2020-7754

Vulnerability identifier: #VU76389

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7754

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Npm-user-validate
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
openEuler
rh-nodejs12-nodejs-nodemon (Red Hat package)
npm
v8-devel
rh-nodejs10-nodejs (Red Hat package)
rh-nodejs12-nodejs (Red Hat package)
nodejs
nodejs-full-i18n
nodejs-debuginfo
nodejs-libs
nodejs-debugsource
nodejs-devel
nodejs-docs
rh-nodejs14-nodejs (Red Hat package)
IBM InfoSphere Information Server

Install updates from vendor's website.

Npm-user-validate - update to 1.0.1
rh-nodejs12-nodejs-nodemon (Red Hat package) - update to 2.0.3-1.el7
npm - update to 6.14.16-1.12.22.11.1
v8-devel - update to 7.8.279.23-1.12.22.11.1
rh-nodejs10-nodejs (Red Hat package) - update to 10.23.1-2.el7
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
rh-nodejs12-nodejs (Red Hat package) - update to 12.20.1-1.el7
nodejs - update to 12.22.11-1
nodejs-full-i18n - update to 12.22.11-1
nodejs-debuginfo - update to 12.22.11-1
nodejs-libs - update to 12.22.11-1
nodejs-debugsource - update to 12.22.11-1
nodejs-devel - update to 12.22.11-1
nodejs-docs - update to 12.22.11-1
rh-nodejs14-nodejs (Red Hat package) - update to 14.15.4-2.el7

• https://github.com/npm/npm-user-validate/commit/c8a87dac1a4cc6988b5418f30411a8669bef204e
• https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1019353
• https://snyk.io/vuln/SNYK-JS-NPMUSERVALIDATE-1019352

• Multiple vulnerabilities in IBM InfoSphere Information Server
• openEuler update for nodejs
• Red Hat Software Collections update for rh-nodejs14-nodejs
• Red Hat Software Collections update for rh-nodejs12-nodejs
• Red Hat Software Collections update for rh-nodejs10-nodejs
• Red Hat Enterprise Linux 8 update for the nodejs:10 module
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module