The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. https://devhub.checkmarx.com/cve-details/CVE-2024-4068/ https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308 https://github.com/micromatch/braces/issues/35
Created ansible tracking bugs for this issue: Affects: epel-all [bug 2280611] Affects: fedora-all [bug 2280615] Created breeze-icon-theme tracking bugs for this issue: Affects: fedora-all [bug 2280616] Created cachelib tracking bugs for this issue: Affects: fedora-all [bug 2280617] Created fbthrift tracking bugs for this issue: Affects: fedora-all [bug 2280618] Created golang-github-prometheus tracking bugs for this issue: Affects: epel-7 [bug 2280610] Affects: epel-all [bug 2280612] Created golang-github-task tracking bugs for this issue: Affects: fedora-all [bug 2280619] Created h3 tracking bugs for this issue: Affects: fedora-all [bug 2280620] Created mozjs78 tracking bugs for this issue: Affects: fedora-all [bug 2280621] Created nodejs-bash-language-server tracking bugs for this issue: Affects: fedora-all [bug 2280622] Created nodejs-diagnostic-language-server tracking bugs for this issue: Affects: fedora-all [bug 2280623] Created nodejs-nodemon tracking bugs for this issue: Affects: fedora-all [bug 2280624] Created onnxruntime tracking bugs for this issue: Affects: fedora-all [bug 2280625] Created pgadmin4 tracking bugs for this issue: Affects: fedora-all [bug 2280626] Created phpMyAdmin tracking bugs for this issue: Affects: fedora-all [bug 2280627] Created qt6-qtwebengine tracking bugs for this issue: Affects: fedora-all [bug 2280628] Created rstudio tracking bugs for this issue: Affects: fedora-all [bug 2280629] Created seamonkey tracking bugs for this issue: Affects: epel-all [bug 2280613] Affects: fedora-all [bug 2280630] Created yarnpkg tracking bugs for this issue: Affects: epel-all [bug 2280614] Affects: fedora-all [bug 2280631]
bugzilla-- :(
This issue has been addressed in the following products: Red Hat Migration Toolkit for Containers 1.8 Via RHSA-2024:7164 https://access.redhat.com/errata/RHSA-2024:7164
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Via RHSA-2024:8077 https://access.redhat.com/errata/RHSA-2024:8077
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Via RHSA-2024:8076 https://access.redhat.com/errata/RHSA-2024:8076
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Via RHSA-2024:8075 https://access.redhat.com/errata/RHSA-2024:8075
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2024:8080 https://access.redhat.com/errata/RHSA-2024:8080
This issue has been solved in RHACM 2.10.4 via this public advisory https://access.redhat.com/errata/RHSA-2024:4464
This issue has been solved in RHACM 2.9.4 via this public advisory https://access.redhat.com/errata/RHBA-2024:3593
This issue has been solved in MCE 2.5.3 via this public advisory https://access.redhat.com/errata/RHBA-2024:2862
This issue has been solved in MCE 2.4.5 via this public advisory https://access.redhat.com/errata/RHBA-2024:3555
This issue has been addressed in the following products: HawtIO 4.0.0 for Red Hat build of Apache Camel 4 Via RHSA-2024:11023 https://access.redhat.com/errata/RHSA-2024:11023