Bug 1980286 (CVE-2021-32723)

Summary:	CVE-2021-32723 npm-prismjs: a malicious (long) string will take a long time to highlight may result in ReDoS
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anharris, anpicker, bmontgom, bniver, eparis, fjansen, flucifre, gmeno, hvyas, jburrell, jwendell, mbenjamin, mhackett, nstielau, rcernich, sostapov, spasquie, sponnaga, twalsh, vereddy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	npm-prismjs 1.24.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in npm-prismjs. An attacker can craft a string that will take a very long time to highlight when used to work with un-trusted text resulting in ReDoS. This can affect the system availability. There is no known risk of privilege escalation on data compromise.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1981616, 1981864
Bug Blocks:	1980287

Description Marian Rehak 2021-07-08 09:16:47 UTC

An attacker can craft a string that will take a very very long time to highlight and result in ReDoS.  As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text.

Upstream Reference:

https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg

Comment 3 subhro 2021-07-13 01:45:18 UTC

Upstream fix: https://github.com/PrismJS/prism/pull/2774/files