Incorrect Regular Expression in debug - CVE-2017-16137
Published: March 4, 2024
Vulnerability identifier: #VU87001
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-16137
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Affected software
debug
IBM Planning Analytics Workspace
IBM Cloud Pak for Security
QRadar User Behavior Analytics
QRadar Suite
IBM Planning Analytics Workspace
IBM Cloud Pak for Security
QRadar User Behavior Analytics
QRadar Suite
How to mitigate CVE-2017-16137
Cybersecurity Help is currently unaware of any official solution to address this vulnerability..
debug - update to 3.1.0
QRadar Suite - update to 1.10.19.0
IBM Planning Analytics Workspace - update to 2.0.94
QRadar User Behavior Analytics - update to 4.1.16
QRadar Suite - update to 1.10.19.0
IBM Planning Analytics Workspace - update to 2.0.94
QRadar User Behavior Analytics - update to 4.1.16
External References
- https://github.com/visionmedia/debug/issues/501
- https://github.com/visionmedia/debug/pull/504
- https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E
- https://nodesecurity.io/advisories/534