Inefficient regular expression complexity in path-to-regexp - CVE-2024-45296

Vulnerability identifier: #VU98132

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-45296

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
path-to-regexp
watsonx.data
Support for Hyperledger Fabric
Astronomer with IBM
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
Cloud Pak for Network Automation
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Data Product Hub
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Watson Studio on Cloud Pak for Data
IBM Business Automation Manager Open Editions
IBM OpenPages with Watson
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite Ai Service
Cognos Analytics Mobile (iOS)
Cognos Analytics Mobile (Android)
Storage Defender - Resiliency Service
QRadar Deployment Intelligence App
Security QRadar EDR
Application Modernization Accelerator
Cognos Dashboards on Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
QRadar Log Source Management App
Db2 Big SQL
Robotic Process Automation for Cloud Pak
Business Automation Insights
Netcool Operations Insight
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling External Authentication Server
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite - AI Broker
Bitbucket Data Center
IBM Spectrum Protect Plus
Jira Service Management Server
Jira Service Management Data Center
IBM Security QRadar Log Management AQL Plugin
IBM Process Mining
Ansible Automation Platform
Qradar Advisor
Red Hat Advanced Cluster Management for Kubernetes
Unified OSS Console Assurance Monitoring (UOCAM)
Red Hat OpenShift Dev Spaces
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
OpenShift Logging
IBM Safer Payments
Confluence Data Center
IBM Maximo Application Suite
App Connect Enterprise Certified Container
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Observability with Instana
QRadar Suite
Splunk Enterprise
IBM Security QRadar Analyst Workflow
IBM Security SOAR
Argo CD
Network Observability plugin for the Openshift Console
IBM Content Navigator
IBM Cloud Pak System
IBM Edge Application Manager
IBM DataPower Gateway
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
IBM License Metric Tool
Event Streams
IBM QRadar Data Synchronization App
IBM Cognos Controller
Ubuntu
Red Hat OpenShift Serverless
OpenShift Service Mesh
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
node-path-to-regexp (Ubuntu package)
receptor (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
ansible-core (Red Hat package)
automation-controller (Red Hat package)
Red Hat OpenShift GitOps
QRadar Pulse App
Planning Analytics Local
IBM Storage Scale System
Confluence Server
IBM App Connect Enterprise

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Install updates from vendor's website.

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6