Inefficient regular expression complexity in word-wrap - CVE-2023-26115

Vulnerability identifier: #VU79799

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-26115

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

word-wrap
Cloud Pak for Network Automation
IBM Business Automation Manager Open Editions
Business Automation Insights
IBM Security QRadar Network Threat Analytics
Storage Defender – Data Protect
IBM Planning Analytics Workspace
IBM Cloud Pak for Watson AIOps
QRadar Suite
IBM Cloud Pak for Multicloud Management
IBM Edge Application Manager
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM App Connect Enterprise
Fedora
Network Observability plugin for the Openshift Console
Netcool Operations Insight
App Connect Enterprise Certified Container
IBM Cloud Pak for Business Automation
IBM Automation Decision Services
QRadar Pulse App
IBM Cloud Pak System
magicmirror
IBM Cognos Analytics

Install update from vendor's website.

word-wrap - update to 1.2.4
QRadar Suite - update to 1.10.18.0
IBM Cloud Pak for Multicloud Management - update to 2.3.8
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.3
Red Hat OpenShift Container Platform - update to 4.14.6
IBM Business Automation Manager Open Editions - update to 9.0.1
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Security QRadar Network Threat Analytics - update to 1.4.0
Network Observability plugin for the Openshift Console - update to 1.4.0
Netcool Operations Insight - update to 1.6.10
Migration Toolkit for Containers - update to 1.8.0
Storage Defender – Data Protect - update to 2.0
IBM Planning Analytics Workspace - update to 2.0.91
QRadar Pulse App - update to 2.2.11
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
magicmirror - update to 2.24.0-1.fc39
IBM Cloud Pak for Watson AIOps - update to 4.1.2
App Connect Enterprise Certified Container - addressed in versions 5.0.10, 9.1.0
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.24, 23.0.1.2
IBM Automation Decision Services - update to 23.0.1 IF003

• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657
• https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39
• https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973

• Regular expression denial of service in word-wrap
• Fedora 39 update for magicmirror
• IBM App Connect Enterprise Certified Container update for Node.js
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple Vulnerabilities in IBM CloudPak for Watson AIOps
• Multiple vulnerabilities in IBM QRadar Pulse App
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Network Observability for OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Storage Defender - Data Protect
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in IBM Security QRadar Network Threat Analytics
• Multiple vulnerabilities in IBM Business Automation Insights