Bug 1347677 (CVE-2016-1000022)

Summary:	CVE-2016-1000022 nodejs-negotiator: Regular expression denial-of-service
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bleanhar, ccoleman, dmcphers, jialiu, jkeck, jokerman, kseifried, lmeyer, mmccomas, tchollingsworth, tdawson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-negotiator 0.6.1	Doc Type:	If docs needed, set a value
Doc Text:	A regular expression denial of service flaw was found in Negotiator. An attacker able to make an application using Negotiator to perform matching using a specially crafted glob pattern could cause the application to consume an excessive amount of CPU.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-09-20 02:09:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1347678, 1347679, 1348310
Bug Blocks:	1347680

Description Andrej Nemec 2016-06-17 11:44:51 UTC

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa.

The header for "Accept-Language", when parsed by negotiator is vulnerable to Regular Expression Denial of Service via a specially crafted string.

External references:

https://nodesecurity.io/advisories/106

Comment 1 Andrej Nemec 2016-06-17 11:45:32 UTC

Created nodejs-negotiator tracking bugs for this issue:

Affects: fedora-all [bug 1347678]
Affects: epel-all [bug 1347679]

Comment 3 Andrej Nemec 2016-07-13 08:07:46 UTC

CVE assignment:

https://github.com/distributedweaknessfiling/DWF-Database/commit/5e607a0cad2769db2be5aafc4d9b1ec49bd7bbbc

Comment 4 errata-xmlrpc 2016-08-11 17:18:01 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Enterprise 3.2
  Red Hat OpenShift Enterprise 3.1

Via RHSA-2016:1605 https://access.redhat.com/errata/RHSA-2016:1605