Bug 1546357 (CVE-2018-1107)

Summary:	CVE-2018-1107 nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, bdettelb, bleanhar, ccoleman, dedgar, dffrench, dmcphers, drusso, hhorak, jgoulding, jkeck, jmadigan, jokerman, jorton, jshepherd, lgriffin, mchappel, ngough, piotr1212, pwright, rrajasek, tomckay, trepel, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	is-myjson-valid 2.17.2, is-myjson-valid 1.4.1	Doc Type:	If docs needed, set a value
Doc Text:	It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:40:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1546358, 1569186, 1598489, 1598490
Bug Blocks:	1546360, 1944336

Description Pedro Sampaio 2018-02-16 20:56:37 UTC

A flaw was discovered in is-myjson-valid before 1.4.1 and 2.17.2. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. It used a regular expression (/^\S+@\S+$/) in order to validate emails. This can cause an impact of about 10 seconds matching time for data 90K characters long.

Upstream patch:

https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976

Upstream issue:

https://github.com/mafintosh/is-my-json-valid/pull/159

External References:

https://snyk.io/vuln/npm:is-my-json-valid:20180214

Comment 1 Pedro Sampaio 2018-02-16 20:58:11 UTC

Created nodejs-is-my-json-valid tracking bugs for this issue:

Affects: fedora-all [bug 1546358]

Comment 4 Jason Shepherd 2018-06-13 21:29:49 UTC

NodeJS is shipped in Openshift Enterprise 3.9 as ImageStreams. Those ImageStreams are the RH Software Collection images. Setting Openshift Enterprise 3 as not affected.

Comment 9 Jason Shepherd 2021-05-07 01:38:18 UTC

Statement:

In Red Hat Quay the is-my-json-valid library is included as a build time dependency of protractor. It's only used at build time, not at runtime reducing the impact to low.

Comment 10 errata-xmlrpc 2021-10-19 12:10:07 UTC

This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917