Inefficient Algorithmic Complexity in http-cache-semantics - CVE-2022-25881

Vulnerability identifier: #VU72750

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-25881

CWE-ID: CWE-407

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to regular expression denial of service that occurs when the server reads the cache policy from the request using this library. A remote unauthenticated attacker can send malicious request header values to the server and perform a denial of service attack.

http-cache-semantics
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
DB2 Data Management Console
IBM Security Verify Information Queue
Db2 Graph
Dell EMC Streaming Data Platform
Cloud Pak for Network Automation
QRadar Deployment Intelligence App
Dell Policy Manager for Secure Connect Gateway (SCG)
Storage Ceph
EMC Cloud Tiering Appliance
Oracle Linux
Amazon Linux AMI
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Web and Scripting Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
openSUSE Leap
openEuler
API Manager
QRadar Pulse App
API Gateway
Migration Toolkit for Containers
IBM DataPower Gateway
Multicluster Engine for Kubernetes
Red Hat Advanced Cluster Management for Kubernetes
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Integration Bus
IBM QRadar WinCollect Agent
Netcool Operations Insight
Red Hat Integration - Service Registry
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Spectrum Control
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
Splunk Enterprise
IBM Security QRadar Analyst Workflow
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
nodejs-nodemon
nodejs-nodemon (Red Hat package)
rh-nodejs14 (Red Hat package)
npm
v8-devel
nodejs10-debugsource
nodejs10
nodejs10-devel
nodejs10-docs
npm10
nodejs10-debuginfo
nodejs-debuginfo
nodejs-docs
nodejs-full-i18n
nodejs
nodejs-debugsource
nodejs-libs
nodejs-devel
nodejs12-docs
nodejs12
nodejs12-devel
nodejs12-debugsource
npm12
nodejs12-debuginfo
rh-nodejs14-nodejs (Red Hat package)
npm14
nodejs14-debugsource
nodejs14-debuginfo
nodejs14-devel
nodejs14
nodejs14-docs
corepack14
nodejs (Red Hat package)
npm16
nodejs16-debugsource
nodejs16-devel
nodejs16-debuginfo
nodejs16
nodejs16-docs
corepack16
nodejs18-devel
nodejs18-docs
npm18
nodejs18-debuginfo
nodejs18
nodejs18-debugsource
corepack18
nodejs-packaging
Event Streams
Cloud Pak for Security (CP4S)
IBM QRadar Data Synchronization App
Cloud Pak for Data
IBM App Connect Enterprise
IBM Cloud Pak System
Operational Decision Manager
IBM InfoSphere Information Server

Install updates from vendor's website.

http-cache-semantics - update to 4.1.1
API Manager - update to May 2023
API Gateway - update to May 2023
QRadar Pulse App - update to 2.2.10
Migration Toolkit for Containers - update to 1.7.8
Multicluster Engine for Kubernetes - addressed in versions 2.0.8, 2.1.6, 2.2.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.8, 2.6.5, 2.7.3
DB2 Data Management Console - update to 3.1.13.2
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
Event Streams - update to 11.1.5
IBM QRadar WinCollect Agent - update to 10.1.3
IBM Security Verify Information Queue - update to 10.0.5
IBM DataPower Gateway - update to 10.5.0.5
Db2 Graph - addressed in versions 1.0.0.1562-amd64, 1.0.0.1562-s390x, 1.0.0.1562-ppcle, 1.0.0.1598-amd64, 1.0.0.1598-s390x, 1.0.0.1598-ppcle
Netcool Operations Insight - update to 1.6.8
Dell EMC Streaming Data Platform - update to 1.7.0
Cloud Pak for Security (CP4S) - update to 1.10.12.0
nodejs-nodemon - addressed in versions 2.0.20-3, 2.0.20-3.0.1
nodejs-nodemon (Red Hat package) - update to 2.0.20-3.el9_2
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
Red Hat Integration - Service Registry - update to 2.4.3
Cloud Pak for Network Automation - update to 2.4.4
IBM Fusion HCI - update to 2.6.1
IBM Security QRadar Analyst Workflow - update to 2.32.0
QRadar Deployment Intelligence App - update to 3.0.10
IBM QRadar Data Synchronization App - update to 3.1.2
rh-nodejs14 (Red Hat package) - update to 3.6-2.el7
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.6.4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
Cloud Pak for Data - update to 4.8.5
App Connect Enterprise Certified Container - addressed in versions 5.0.6, 8.1.0
IBM Spectrum Control - update to 5.4.10.2
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.24.00.14
Storage Ceph - update to 6.1
npm - update to 6.14.16-1.12.22.11.4
npm - addressed in versions 6.14.18-1.14.21.3.1.0.1, 8.19.3-1.16.19.1.1.0.2
v8-devel - update to 7.8.279.23-1.12.22.11.4
IBM Maximo Application Suite - addressed in versions 8.8.7, 8.9.3
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 41, 8.11.0.1 Interim fix 21, 8.11.1 Interim fix 10, 8.12.0 Interim fix 2
nodejs10-debugsource - update to 10.24.1-150000.1.59.1
nodejs10 - update to 10.24.1-150000.1.59.1
nodejs10-devel - update to 10.24.1-150000.1.59.1
nodejs10-docs - update to 10.24.1-150000.1.59.1
npm10 - update to 10.24.1-150000.1.59.1
nodejs10-debuginfo - update to 10.24.1-150000.1.59.1
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
nodejs-debuginfo - update to 12.22.11-4
nodejs-docs - update to 12.22.11-4
nodejs-full-i18n - update to 12.22.11-4
nodejs - update to 12.22.11-4
nodejs-debugsource - update to 12.22.11-4
nodejs-libs - update to 12.22.11-4
nodejs-devel - update to 12.22.11-4
nodejs12-docs - update to 12.22.12-150200.4.47.1
nodejs12 - update to 12.22.12-150200.4.47.1
nodejs12-devel - update to 12.22.12-150200.4.47.1
nodejs12-debugsource - update to 12.22.12-150200.4.47.1
npm12 - update to 12.22.12-150200.4.47.1
nodejs12-debuginfo - update to 12.22.12-150200.4.47.1
EMC Cloud Tiering Appliance - update to 13.2.0.2.24
nodejs - addressed in versions 14.21.3-1.0.1, 16.19.1-1.0.2
nodejs-devel - addressed in versions 14.21.3-1.0.1, 16.19.1-1.0.2
nodejs-full-i18n - addressed in versions 14.21.3-1.0.1, 16.19.1-1.0.2
nodejs-docs - addressed in versions 14.21.3-1.0.1, 16.19.1-1.0.2
rh-nodejs14-nodejs (Red Hat package) - update to 14.21.3-2.el7
npm14 - addressed in versions 14.21.3-6.43.1, 14.21.3-150200.15.46.1
nodejs14-debugsource - addressed in versions 14.21.3-6.43.1, 14.21.3-150200.15.46.1
nodejs14-debuginfo - addressed in versions 14.21.3-6.43.1, 14.21.3-150200.15.46.1
nodejs14-devel - addressed in versions 14.21.3-6.43.1, 14.21.3-150200.15.46.1
nodejs14 - addressed in versions 14.21.3-6.43.1, 14.21.3-150200.15.46.1
nodejs14-docs - addressed in versions 14.21.3-6.43.1, 14.21.3-150200.15.46.1
corepack14 - update to 14.21.3-150200.15.46.1
nodejs (Red Hat package) - addressed in versions 16.19.1-1.el9_2, 16.20.2-1.el9_0
npm16 - addressed in versions 16.20.0-8.27.1, 16.20.0-150300.7.21.2, 16.20.0-150400.3.18.2
nodejs16-debugsource - addressed in versions 16.20.0-8.27.1, 16.20.0-150300.7.21.2, 16.20.0-150400.3.18.2
nodejs16-devel - addressed in versions 16.20.0-8.27.1, 16.20.0-150300.7.21.2, 16.20.0-150400.3.18.2
nodejs16-debuginfo - addressed in versions 16.20.0-8.27.1, 16.20.0-150300.7.21.2, 16.20.0-150400.3.18.2
nodejs16 - addressed in versions 16.20.0-8.27.1, 16.20.0-150300.7.21.2, 16.20.0-150400.3.18.2
nodejs16-docs - addressed in versions 16.20.0-8.27.1, 16.20.0-150300.7.21.2, 16.20.0-150400.3.18.2
corepack16 - update to 16.20.0-150400.3.18.2
nodejs - update to 18.12.1-1
nodejs18-devel - addressed in versions 18.16.1-8.9.1, 18.16.1-150400.9.9.1
nodejs18-docs - addressed in versions 18.16.1-8.9.1, 18.16.1-150400.9.9.1
npm18 - addressed in versions 18.16.1-8.9.1, 18.16.1-150400.9.9.1
nodejs18-debuginfo - addressed in versions 18.16.1-8.9.1, 18.16.1-150400.9.9.1
nodejs18 - addressed in versions 18.16.1-8.9.1, 18.16.1-150400.9.9.1
nodejs18-debugsource - addressed in versions 18.16.1-8.9.1, 18.16.1-150400.9.9.1
corepack18 - update to 18.16.1-150400.9.9.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.18, 22.0.2.2
nodejs-packaging - addressed in versions 23-3, 25-1.0.1

• https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
• https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332

• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in QRadar WinCollect Agent
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Red Hat Enterprise Linux 8.4 Extended Update Support update for the nodejs:14 module
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Red Hat Enterprise Linux 8 update for the nodejs:18 module
• Red Hat Enterprise Linux 8 update for the nodejs:16 module
• Red Hat Software Collections update for rh-nodejs14-nodejs
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Red Hat Enterprise Linux 8.6 Extended Update Support update for the nodejs:14 module
• SUSE update for nodejs10
• SUSE update for nodejs14
• SUSE update for nodejs12
• SUSE update for nodejs14
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• SUSE update for nodejs16
• SUSE update for nodejs16
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
• SUSE update for nodejs16
• Multiple vulnerabilities in Oracle Linux
• IBM App Connect Enterprise Certified Container update for http-cache-semantics
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1
• Inefficient algorithmic complexity in IBM DataPower Gateway
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.6
• Inefficient algorithmic complexity in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.0
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.5
• Red Hat Enterprise Linux 9 update for nodejs and nodejs-nodemon
• Red Hat Enterprise Linux 9 update for the nodejs:18 module
• Multiple vulnerabilities in IBM Db2 Graph
• Multiple vulnerabilities in IBM Security Verify Information Queue
• Inefficient algorithmic complexity in IBM InfoSphere Information Server
• Multiple vulnerabilities in QRadar Pulse application add on to IBM QRadar SIEM
• Inefficient algorithmic complexity in IBM Maximo Application Suite
• Multiple vulnerabilities in Axway API Gateway and API Manager
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in Red Hat Integration - Service Registry
• SUSE update for nodejs18
• SUSE update for nodejs18
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in Dell Streaming Data Platform
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Storage Fusion and IBM Storage Fusion HCI
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• Multiple vulnerabilities in IBM Spectrum Control
• Red Hat Enterprise Linux 9.0 Extended Update Support update for nodejs
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Inefficient algorithmic complexity in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Analyst Workflow
• openEuler update for nodejs
• Multiple vulnerabilities in Dell Secure Connect Gateway Policy Manager
• Inefficient algorithmic complexity in IBM Storage Ceph
• Amazon Linux AMI update for nodejs
• Inefficient algorithmic complexity in IBM Cloud Pak for Data
• Anolis OS update for nodejs:14 module
• Anolis OS update for nodejs:16 module
• Multiple vulnerabilities in IBM DB2 Data Management Console