Inefficient regular expression complexity in fast-xml-parser - CVE-2023-34104

Vulnerability identifier: #VU78981

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-34104

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

fast-xml-parser
IBM Cloud Pak for Watson AIOps
QRadar Suite
QRadar User Behavior Analytics
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
Cloud Pak for Data

Install updates from vendor's website.

fast-xml-parser - update to 4.2.4
QRadar Suite - update to 1.10.17.0
IBM Cloud Pak for Watson AIOps - update to 4.1.1
QRadar User Behavior Analytics - update to 4.1.13
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7.1
IBM Decision Optimization for Cloud Pak for Data - update to 4.7.2
Cloud Pak for Data - update to 4.8.5
App Connect Enterprise Certified Container - addressed in versions 5.0.8, 9.0.0
Red Hat Migration Toolkit for Applications - update to 6.2.0

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/39b0e050bb909e8499478657f84a3076e39ce76c

• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Inefficient regular expression complexity in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Inefficient regular expression complexity in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM QRadar Suite software
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Inefficient regular expression complexity in IBM Cloud Pak for Data
• Regex injection in fast-xml-parser