Inefficient regular expression complexity in cookiejar - CVE-2022-25901

Vulnerability identifier: #VU76691

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-25901

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions within the Cookie.parse function. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

cookiejar
IBM Cloud Pak for Watson AIOps
Business Automation Insights
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Dell Data Protection Central
QRadar Pulse App
IBM QRadar Use Case Manager
Netcool Operations Insight
IBM Cloud Transformation Advisor
QRadar User Behavior Analytics
IBM Cloud Pak for Business Automation
Cloud Pak for Security (CP4S)
Cloud Pak for Data

Install update from vendor's website.

cookiejar - update to 2.1.4
QRadar Pulse App - update to 2.2.10
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
Netcool Operations Insight - update to 1.6.10
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 1.8.0
Cloud Pak for Security (CP4S) - update to 1.10.10.0
IBM Cloud Transformation Advisor - update to 3.4.2
IBM QRadar Use Case Manager - update to 3.8.0
QRadar User Behavior Analytics - update to 4.1.11
Cloud Pak for Data - update to 5.0.0
Dell Data Protection Central - update to 19.10.0-4
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.19, 22.0.2.3

• https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5
• https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984
• https://github.com/bmeck/node-cookiejar/pull/39
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681
• https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73

• Denial of service in cookiejar
• Multiple vulnerabilities in QRadar Pulse application add on to IBM QRadar SIEM
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Data Virtualization on Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar Use Case Manager
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Dell Data Protection Central update for third-party components
• Multiple vulnerabilities in Netcool Operations Insight
• Inefficient regular expression complexity in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Business Automation Insights