Bug 1448380 (CVE-2017-18077)

Summary: CVE-2017-18077 nodejs-brace-expansion: Regular expression denial of service
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahardin, avibelli, bdettelb, bleanhar, ccoleman, cmacedo, dedgar, dffrench, dmcphers, drusso, gsterlin, hhorak, jbalunas, jgoulding, jkeck, jmadigan, joelsmith, jokerman, jorton, jshepherd, jsmith.fedora, kseifried, lgriffin, mchappel, ngough, nodejs-sig, pwright, rrajasek, tdawson, thrcka, tkirby, tomckay, trepel, zsvetlik
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: nodejs-brace-expansion 1.1.7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-06-19 05:20:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1448381, 1470126, 1598176, 1598177    
Bug Blocks: 1448382    

Description Andrej Nemec 2017-05-05 10:13:21 UTC
A Regular expression denial-of-service vulnerability was found in nodejs-brace-expansion. Running a specially crafted command would cause the application to hang for long periods of time.



Upstream bug:


Upstream patch:


Comment 1 Andrej Nemec 2017-05-05 10:14:02 UTC
Created nodejs-brace-expansion tracking bugs for this issue:

Affects: fedora-all [bug 1448381]

Comment 8 errata-xmlrpc 2020-06-19 03:44:09 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2020:2625 https://access.redhat.com/errata/RHSA-2020:2625

Comment 9 Product Security DevOps Team 2020-06-19 05:20:21 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 11 Jason Shepherd 2021-05-07 01:49:14 UTC

Red Hat Quay include brace-explansion as a build time dependency. It's not used at runtime and hence has a reduce impact of low.