Bug 1500250

Summary:	nodejs-forwarded: Regular expression Denial of Service
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bleanhar, ccoleman, dedgar, dffrench, dmcphers, drusso, jgoulding, jkeck, jmadigan, jshepherd, jsmith.fedora, kpiwko, kseifried, lgriffin, ngough, nodejs-sig, pbraun, pwright, rrajasek, tjay, trepel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-forwarded 0.1.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-02-16 02:54:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1500251, 1516725, 1516726
Bug Blocks:	1500252

Description Andrej Nemec 2017-10-10 09:35:51 UTC

The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

References:

https://nodesecurity.io/advisories/527

Upstream patch:

https://github.com/jshttp/forwarded/commit/d469116eda4931fbe1c0ccb29497b35930bfa328

Comment 1 Andrej Nemec 2017-10-10 09:37:07 UTC

Created nodejs-forwarded tracking bugs for this issue:

Affects: fedora-all [bug 1500251]

Comment 2 Mark Knowles 2017-11-23 10:33:44 UTC

Created nodejs-forwarded tracking bugs for this issue:

Affects: openshift-1 [bug 1516726]

Comment 4 Jason Shepherd 2018-01-12 05:45:37 UTC

Could not find any usages of vulnerable Express API calls mentioned in Express security notification. "This may affect your application if the following APIs are used: req.host, req.hostname, req.ip, req.ips, req.protocol."
https://expressjs.com/en/changelog/4x.html#4.16.0

Marking RHMAP as notaffected.