Bug 1999784 (CVE-2021-3749)

Summary:	CVE-2021-3749 nodejs-axios: Regular expression denial of service in trim function
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alazarot, alegrand, amuller, anpicker, anstephe, aos-bugs, bmontgom, caswilli, dkuc, dwhatley, dymurray, emingora, eparis, erooth, etirelli, fjansen, gghezzo, gparvin, ibek, ibolton, jburrell, jhadvig, jmatthew, jmontleo, jokerman, jramanat, jrokos, jshaughn, jstastny, jwendell, kaycoth, kconner, krathod, kverlaen, lmadsen, mburns, mgarciac, mnovotny, mrunge, nstielau, pahickey, pjindal, psegedy, rcernich, rfreiman, rguimara, rrajasek, slucidi, spasquie, sponnaga, sseago, stcannon, twalsh, tzimanyi, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	axios 0.21.2, axios 0.21.3	Doc Type:	If docs needed, set a value
Doc Text:	A Regular Expression Denial of Service (ReDoS) vulnerability was found in the nodejs axios. This flaw allows an attacker to provide crafted input to the trim function, which might cause high resources consumption and as a consequence lead to denial of service. The highest threat from this vulnerability is system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-29 18:21:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2000279, 2000280, 2000281, 2000282, 2000285, 2001611, 2001612, 2001614, 2002204, 2006255, 2006256, 2008492, 2008493, 2008494, 2008495, 2008496, 2008497, 2008498, 2020092, 2020093, 2020094
Bug Blocks:	1999785

Description Pedro Sampaio 2021-08-31 18:02:48 UTC

axios is vulnerable to Inefficient Regular Expression Complexity in function isURLSearchParams in utils.js.

References:

https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31

Comment 4 Przemyslaw Roguski 2021-09-06 14:41:07 UTC

the upstream fix:
https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
also back-ported to 0.21.2

Comment 12 errata-xmlrpc 2021-09-29 14:34:34 UTC

This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.6

Via RHSA-2021:3694 https://access.redhat.com/errata/RHSA-2021:3694

Comment 13 Product Security DevOps Team 2021-09-29 18:21:06 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3749

Comment 14 errata-xmlrpc 2021-11-11 18:32:30 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8

Via RHSA-2021:4618 https://access.redhat.com/errata/RHSA-2021:4618

Comment 15 errata-xmlrpc 2021-12-01 17:24:07 UTC

This issue has been addressed in the following products:

  RHACS-3.67-RHEL-8

Via RHSA-2021:4902 https://access.redhat.com/errata/RHSA-2021:4902

Comment 16 errata-xmlrpc 2022-03-10 16:01:53 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.10

Via RHSA-2022:0056 https://access.redhat.com/errata/RHSA-2022:0056

Comment 17 errata-xmlrpc 2022-04-07 17:58:58 UTC

This issue has been addressed in the following products:

  OpenShift Service Mesh 2.0

Via RHSA-2022:1276 https://access.redhat.com/errata/RHSA-2022:1276