Bug 1964461 (CVE-2021-33502)

Summary:	CVE-2021-33502 nodejs-normalize-url: ReDoS for data URLs
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alcohan, alegrand, anpicker, aos-bugs, bdettelb, bmontgom, caswilli, crizzo, dblechte, dfediuck, doconnor, eedri, eparis, erooth, gghezzo, gparvin, hhorak, jbalunas, jburrell, jcantril, jdobes, jhadvig, jmitchel, jokerman, jorton, jramanat, jweiser, jwendell, kakkoyun, kaycoth, kconner, kshier, mgoldboi, michal.skrivanek, mpoole, nodejs-maint, nstielau, orabin, pahickey, pbohmill, pkrupa, rcernich, rhaigner, sbonazzo, sgratch, sherold, spasquie, sponnaga, stcannon, teagle, thee, thrcka, tomckay, twalsh, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	normalize-url 4.5.1, normlize-url 5.3.1, normalize-url 6.0.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in normalize-url. Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-28 13:07:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1965728, 1965729, 1965730, 1965731, 1965732, 1966191, 1966192, 1966193, 1966449, 1966450, 1966451, 1966452, 1972275, 1972276, 1977826, 1977827, 2029474, 2029475, 2029519, 2029520, 2029522, 2124231
Bug Blocks:	1964462

Description Guilherme de Almeida Suckevicz 2021-05-25 14:26:25 UTC

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Reference:
https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1

Comment 1 Mark Cooper 2021-05-27 01:40:59 UTC

Looks like this only affects v4.4.0 on-wards as the `normalizeDataUrl` only got added here: https://github.com/sindresorhus/normalize-url/commit/7df5aff5024f848a4bf69a6513bdffe8e5f10bcb and wasn't moved from another location. 

Haven't look if that regex is vuln itself, but is changed pretty frequently and also seems likely. 

The quay-registry-container includes v1.9.0 and does not included the vulnerability.

Comment 3 Mark Cooper 2021-05-31 00:08:41 UTC

Upstream fix: https://github.com/sindresorhus/normalize-url/commit/b1fdb5120b6d27a88400d8800e67ff5a22bd2103

Comment 7 errata-xmlrpc 2021-07-28 08:32:18 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:2931 https://access.redhat.com/errata/RHSA-2021:2931

Comment 8 errata-xmlrpc 2021-07-28 08:35:56 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:2932 https://access.redhat.com/errata/RHSA-2021:2932

Comment 9 Product Security DevOps Team 2021-07-28 13:07:06 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-33502

Comment 10 errata-xmlrpc 2021-08-06 00:51:25 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 7
  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8

Via RHSA-2021:3016 https://access.redhat.com/errata/RHSA-2021:3016

Comment 15 errata-xmlrpc 2021-12-15 19:27:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:5171 https://access.redhat.com/errata/RHSA-2021:5171

Comment 16 errata-xmlrpc 2022-01-25 09:23:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:0246 https://access.redhat.com/errata/RHSA-2022:0246

Comment 17 errata-xmlrpc 2022-02-01 21:14:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:0350 https://access.redhat.com/errata/RHSA-2022:0350

Comment 18 errata-xmlrpc 2022-05-26 16:22:04 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization Engine 4.4

Via RHSA-2022:4711 https://access.redhat.com/errata/RHSA-2022:4711

Comment 19 errata-xmlrpc 2022-09-20 12:23:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:6595 https://access.redhat.com/errata/RHSA-2022:6595