Bug 1561980 (CVE-2018-7158)

Summary:	CVE-2018-7158 nodejs: path module regular expression denial of service
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, athmanem, bleanhar, cbuissar, ccoleman, dbaker, dedgar, dmcphers, hhorak, jgoulding, jokerman, jorton, mchappel, mrunge, nodejs-sig, piotr1212, rhel8-maint, sgallagh, tchollingsworth, thrcka, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs 4.9.0, nodejs 6.0	Doc Type:	If docs needed, set a value
Doc Text:	It was found that the 'path' module from Node.js was vulnerable to a Regular Expression Denial of Service (REDoS) flaw. An attacker able to provide a specially crafted file path to a Node.js script could force it to hang indefinitely.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-07-17 12:38:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1562026, 1562027, 1562028, 1562034, 1565268, 1565604
Bug Blocks:	1561984

Description Adam Mariš 2018-03-29 09:50:42 UTC

A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions.

References:

https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.9.0

Comment 1 Adam Mariš 2018-03-29 12:07:02 UTC

Created nodejs tracking bugs for this issue:

Affects: fedora-all [bug 1562027]
Affects: epel-all [bug 1562026]

Comment 5 Cedric Buissart 2018-04-06 14:30:19 UTC

Upstream commits for nodejs-4 implementation :
https://github.com/nodejs/node/commit/4196fcf23e
https://github.com/nodejs/node/commit/bf00665af6

Comment 9 Cedric Buissart 2018-04-10 12:12:40 UTC

Contrary to what upstream changelog suggests, it appears that this CVE affects only nodejs-4.x. Node.js 6 and above had the 'path' library rewritten to avoid inefficient regular expressions. 
In Node.js 4, the fix was to backport the newer path parsing method from Node.js 8.

Comment 10 Jason Shepherd 2018-06-13 21:15:36 UTC

NodeJS is only provided in Openshift Enterprise 3.9 via Red Hat Software Collections. Changing Openshift Enterprise to not affected.