Inefficient regular expression complexity in path-to-regexp - CVE-2024-45296

Vulnerability identifier: #VU98132

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45296

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

path-to-regexp
watsonx.data
Support for Hyperledger Fabric
Astronomer with IBM
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
Cloud Pak for Network Automation
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Data Product Hub
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Watson Studio on Cloud Pak for Data
IBM Business Automation Manager Open Editions
IBM OpenPages with Watson
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite Ai Service
Cognos Analytics Mobile (iOS)
Cognos Analytics Mobile (Android)
Storage Defender - Resiliency Service
QRadar Deployment Intelligence App
Security QRadar EDR
Application Modernization Accelerator
Cognos Dashboards on Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
QRadar Log Source Management App
Db2 Big SQL
Robotic Process Automation for Cloud Pak
Business Automation Insights
Netcool Operations Insight
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling External Authentication Server
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite - AI Broker
Bitbucket Data Center
IBM Spectrum Protect Plus
Jira Service Management Server
Jira Service Management Data Center
IBM Security QRadar Log Management AQL Plugin
IBM Process Mining
Ansible Automation Platform
Qradar Advisor
Red Hat Advanced Cluster Management for Kubernetes
Unified OSS Console Assurance Monitoring (UOCAM)
Red Hat OpenShift Dev Spaces
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
OpenShift Logging
IBM Safer Payments
Confluence Data Center
IBM Maximo Application Suite
App Connect Enterprise Certified Container
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Observability with Instana
QRadar Suite
Splunk Enterprise
IBM Security QRadar Analyst Workflow
IBM Security SOAR
Argo CD
Network Observability plugin for the Openshift Console
IBM Content Navigator
IBM Cloud Pak System
IBM Edge Application Manager
IBM DataPower Gateway
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
IBM License Metric Tool
Event Streams
IBM QRadar Data Synchronization App
IBM Cognos Controller
Ubuntu
Red Hat OpenShift Serverless
OpenShift Service Mesh
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
node-path-to-regexp (Ubuntu package)
receptor (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
ansible-core (Red Hat package)
automation-controller (Red Hat package)
Red Hat OpenShift GitOps
QRadar Pulse App
Planning Analytics Local
IBM Storage Scale System
Confluence Server
IBM App Connect Enterprise

Install updates from vendor's website.

path-to-regexp - addressed in versions 0.1.10, 1.9.0, 3.3.0, 6.3.0, 8.0.0
Astronomer with IBM - update to 1.0.1
Netcool Operations Insight - update to 1.6.15
Data Virtualization (DV) on Cloud Pak for Data (CPD) - addressed in versions 2.2.8, 3.1.0
QRadar Suite - update to 1.10.27.0
Argo CD - addressed in versions 2.10.17, 2.11.9, 2.12.4
Watson Query on Cloud Pak for Data - update to 2.2.8
IBM Cloud Transformation Advisor - update to 3.10.2
IBM Fusion HCI - update to 2.10.0
IBM Cloud Pak System - update to 2.3.6.0
Cloud Pak for Network Automation - update to 2.7.8
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Knowledge Catalog Premium Cartridge - update to 5.2
Data Product Hub - update to 5.1.0
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.1
IBM Sterling External Authentication Server - update to 6.1.0.2 iFix 03
IBM Business Automation Manager Open Editions - update to 8.0.7
IBM OpenPages with Watson - addressed in versions 8.3.0.3.1, 9.0.0.5.1
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.27, 8.7.21, 9.0.14
Maximo Application Suite - IoT Component - addressed in versions 8.7.28, 8.8.24, 9.0.14, 9.1.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.15, 8.11.13, 9.0.5
Splunk Enterprise - addressed in versions 9.1.7, 9.2.4, 9.3.2
IBM Maximo Application Suite - AI Broker - update to 9.0.4
Maximo Application Suite Ai Service - update to 9.1.11
IBM License Metric Tool - update to 9.2.39
Bitbucket Data Center - addressed in versions 9.4.3, 9.5.1
IBM Spectrum Protect Plus - update to 10.1.17.1
Jira Service Management Server - update to 10.3.6
Jira Service Management Data Center - update to 10.3.6
IBM DataPower Gateway - addressed in versions 10.5.0.14, 10.6.0.2
Event Streams - update to 11.7.0
Red Hat OpenShift Serverless - update to 1
node-path-to-regexp (Ubuntu package) - addressed in versions 1.0.1-1ubuntu0.16.04.1~esm1, 1.0.1-1ubuntu0.18.04.1~esm1, 6.1.0-2ubuntu0.1~esm1, 6.2.0-2ubuntu0.1~esm1, 6.2.1-1ubuntu0.1~esm1
IBM Security QRadar Log Management AQL Plugin - update to 1.1.1
watsonx.data - update to 1.1.5
Cognos Analytics Mobile (iOS) - update to 1.1.20
Cognos Analytics Mobile (Android) - update to 1.1.20
receptor (Red Hat package) - addressed in versions 1.5.1-1.el8ap, 1.5.1-1.el9ap
Network Observability plugin for the Openshift Console - update to 1.7.0
Migration Toolkit for Containers - update to 1.8.5
Red Hat OpenShift GitOps - update to 1.13.2
IBM Process Mining - update to 1.15.0 IF003
Planning Analytics Local - addressed in versions 2.0.0.101, 2.1.8
Storage Defender - Resiliency Service - update to 2.0.9
QRadar Pulse App - update to 2.2.15
Ansible Automation Platform - update to 2.4
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-8.el8ap, 2.4-8.el9ap
OpenShift Service Mesh - update to 2.6.2
Multicluster Engine for Kubernetes - addressed in versions 2.6.4, 2.7.2
Qradar Advisor - update to 2.6.6
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.11.4, 2.12.1
ansible-core (Red Hat package) - addressed in versions 2.15.13-1.el8ap, 2.15.13-1.el9ap
IBM Security QRadar Analyst Workflow - update to 2.34.0
IBM Content Navigator - addressed in versions 3.0.11 IF18, 3.0.15 IF5
QRadar Deployment Intelligence App - update to 3.0.16
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.10
IBM QRadar Data Synchronization App - update to 3.2.1
Security QRadar EDR - update to 3.12.13
Red Hat OpenShift Dev Spaces - update to 3.17.0
Application Modernization Accelerator - update to 4.0.1
automation-controller (Red Hat package) - addressed in versions 4.5.13-1.el8ap, 4.5.13-1.el9ap
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.7, 5.1.0
Cognos Dashboards on Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.14.13, 4.15.9, 4.16.5, 4.17.0
Red Hat OpenShift Container Platform - addressed in versions 4.16.16, 4.17.1, 4.17.15
IBM Decision Optimization for Cloud Pak for Data - update to 5.1
watsonx Assistant Cartridge - update to 5.1.3
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
IBM Storage Scale System - addressed in versions 5.1.9.7, 5.2.2.0
OpenShift Logging - update to 5.9.7
IBM Safer Payments - addressed in versions 6.4.2.09, 6.5.0.07, 6.6.0.05, 6.7.0.01
QRadar Log Source Management App - update to 7.0.11
Db2 Big SQL - update to 7.8
Confluence Server - addressed in versions 8.5.17, 9.2.6, 9.4.0, 9.5.1, 10.0.2, 10.1.0
Confluence Data Center - addressed in versions 8.5.17, 9.2.6, 9.4.0, 9.5.1, 10.0.2, 10.1.0
IBM Maximo Application Suite - addressed in versions 8.10.22, 8.11.19, 9.0.8
IBM Cognos Controller - addressed in versions 11.0.1.4, 11.1.0.2
App Connect Enterprise Certified Container - addressed in versions 12.0.8, 12.8.0
IBM App Connect Enterprise - update to 12.0.12.7
IBM Business Automation Workflow - addressed in versions 21.0.3-IF037, 24.0.0-IF003
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.18, 23.0.19
IBM Robotic Process Automation - addressed in versions 21.0.7.19, 23.0.18
Business Automation Insights - update to 24.0.0.0.1
IBM Security SOAR - update to 51.0.4.0
IBM Observability with Instana - update to 285

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6

• Regular expression denial of service in pillarjs path-to-regexp
• Multiple vulnerabilities in OpenShift Logging 5.9
• Multiple vulnerabilities in OpenShift Service Mesh 2.6
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Argo CD update for pillarjs path-to-regexp
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM Edge Application Manager
• IBM App Connect Enterprise update for pillarjs Path-to-RegExp
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.7
• IBM Safer Payments update for pillarjs path-to-regexp
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• IBM Business Automation Workflow update for pillarjs Path-to-RegExp
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (Android)
• Multiple vulnerabilities in HPE Unified OSS Console Assurance Monitoring
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (iOS)
• Multiple vulnerabilities in QRadar Suite Software
• Denial of service in IBM DataPower Gateway
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM QRadar Pulse App
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.17
• IBM Watson Discovery update for pillarjs Path-to-RegExp
• Multiple vulnerabilities in IBM Observability with Instana
• IBM Security SOAR update for pillarjs Path-to-RegExp
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• IBM Robotic Process Automation for Cloud Pak update for pillarjs Path-to-RegExp
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• IBM Content Navigator update for pillarjs Path-to-RegExp
• Multiple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in IBM Data Product Hub
• Inefficient regular expression complexity in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Security QRadar Log Management AQL Plugin
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.15
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.14
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• IBM watsonx.data update for path-to-regexp
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• IBM Maximo Application Suite update for path-to-regexp
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in IBM Support for Hyperledger Fabric
• Multiple vulnerabilities in IBM Maximo Application Suite - AI Broker
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• IBM Maximo Application Suite - Monitor Component update for pillarjs Path-to-RegExp
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in QRadar Advisor With Watson for IBM QRadar SIEM
• Multiple vulnerabilities in IBM Data Virtualization on Cloud Pak for Data
• Multiple vulnerabilities in IBM License Metric Tool
• Bitbucket Data Center update for path-to-regexp
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge
• IBM Event Streams update for package path-to-regexp
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Cloud Pak System
• IBM Sterling External Authentication Server update for path-to-regexp
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
• Multiple vulnerabilities in Astronomer with IBM
• Multiple vulnerabilities in IBM Watson Studio for IBM Cloud Pak for Data
• Confluence Data Center and Server update for pillarjs path-to-regexp
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Jira Service Management Data Center and Server update for path-to-regexp
• IBM Big SQL on Cloud Pak for Data update for path-to-regexp
• Multiple vulnerabilities in IBM Maximo AI Service
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge
• Ubuntu update for node-path-to-regexp