Bug 1941471 (CVE-2021-27290)

Summary:	CVE-2021-27290 nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agerstmayr, alegrand, anpicker, aturgema, bdettelb, bmontgom, cfeist, cluster-maint, dblechte, dfediuck, eedri, eparis, erooth, gghezzo, gparvin, grafana-maint, hhorak, idevat, jburrell, jcantril, jokerman, jorton, jramanat, jshaughn, jsmith.fedora, jweiser, jwendell, kakkoyun, kconner, kmalyjur, lcosic, mgoldboi, mgoodwin, michal.skrivanek, mlisik, mwringe, nathans, nodejs-maint, nstielau, omular, patrickm, periklis, pkrupa, ploffay, rcernich, sbonazzo, sgratch, sherold, sponnaga, stcannon, surbania, thee, tojeline, tomckay, twalsh, yturgema, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ssri 8.0.1, ssri 7.1.1, ssri 6.0.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service (ReDoS). This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-28 13:06:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1941472, 1945285, 1945286, 1945287, 1945288, 1945289, 1945290, 1945299, 1945300, 1945301, 1945302, 1945303, 1945304, 1945305, 1981756, 1981758, 1991578, 1991579, 1991580, 1991581, 1991582, 1991583
Bug Blocks:	1941473

Description Marian Rehak 2021-03-22 08:48:16 UTC

Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

Reference:

https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf

Comment 1 Marian Rehak 2021-03-22 08:48:46 UTC

Created nodejs-ssri tracking bugs for this issue:

Affects: fedora-all [bug 1941472]

Comment 2 Tomas Hoger 2021-03-22 10:57:52 UTC

The issue was fixed upstream in version 8.0.1 via this commit:

https://github.com/npm/ssri/commit/76e223317d971

The Donyensec advisory also notes that the issue was introduced in version 5.2.2 via the following commit aimed to address CVE-2018-7651:

https://github.com/npm/ssri/commit/d0ebcdc

Comment 15 Stoyan Nikolov 2021-04-22 15:53:25 UTC

Statement:

Whilst the OpenShift ServiceMesh (OSSM) servicemesh-grafana and servicemesh-prometheus include the vulnerable ssri library, the vulnerable "strict" option is not used. Similar to OSSM, OpenShift Container Platform (OCP) or Red Hat Advance Cluster Management for Kubernetes (RHACM) components include the vulnerable ssri library but the "strict" option is not used. Additionally access to the vulnerable library is protected by OpenShift OAuth what reducing impact by this flaw to LOW. Therefore these OSSM, OCP and RHACM components have been marked as wont-fix and may be addressed in a future updates.

Red Hat Virtualization includes ssri in cockpit-ovirt, ovirt-web-ui and ovirt-engine-ui-extensions, but the vulnerable "strict" option is not used. Additionally access to the vulnerable library is protected by RHV authentication. Therefore  the impact of this flaw for RHV has been reduced to LOW and components have been marked as wont-fix and may be addressed in a future update.

Red Hat Quay includes ssri as a dependency of webpack which is only used at build time. The library is not used at runtime, reducing the impact of this vulnerability to low.

Comment 17 errata-xmlrpc 2021-07-28 08:32:17 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:2931 https://access.redhat.com/errata/RHSA-2021:2931

Comment 18 errata-xmlrpc 2021-07-28 08:35:48 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:2932 https://access.redhat.com/errata/RHSA-2021:2932

Comment 19 Product Security DevOps Team 2021-07-28 13:06:48 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27290

Comment 20 errata-xmlrpc 2021-08-10 13:56:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3073 https://access.redhat.com/errata/RHSA-2021:3073

Comment 21 errata-xmlrpc 2021-08-10 13:57:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3074 https://access.redhat.com/errata/RHSA-2021:3074

Comment 22 errata-xmlrpc 2021-09-22 08:51:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:3639 https://access.redhat.com/errata/RHSA-2021:3639

Comment 23 errata-xmlrpc 2021-09-22 09:00:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3638 https://access.redhat.com/errata/RHSA-2021:3638