Bug 2126277 (CVE-2022-25858)
| Summary: | CVE-2022-25858 terser: insecure use of regular expressions leads to ReDoS | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Avinash Hanwate <ahanwate> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | agerstmayr, aileenc, alazarot, amctagga, anstephe, asoldano, aturgema, balejosg, bbaranow, bbuckingham, bcoca, bcourt, bdettelb, bmaxwell, brian.stansberry, btotty, cdewolf, chazlett, chousekn, cluster-maint, cmeyers, darran.lofthouse, davidn, dfediuck, dkreling, dosoudil, dwhatley, dymurray, eclipseo, ehelms, emingora, eric.wittmann, etirelli, extras-orphan, fjuma, gblomqui, gmalinko, go-sig, gparvin, grafana-maint, ibek, ibolton, idevat, iweiss, janstey, jburrell, jcammara, jcantril, jhardy, jkurik, jmatthew, jmontleo, jobarker, jochrist, jpavlik, jramanat, jrokos, jshaughn, jsherril, jwendell, jwon, kmalyjur, kverlaen, lemenkov, lgao, link, lzap, mabashia, mgoodwin, mhulan, michal.skrivanek, michel, mlisik, mmccune, mnovotny, mosmerov, mperina, mpospisi, msochure, msvehla, mwringe, myarboro, nathans, nboldt, njean, nmoumoul, notting, nwallace, omular, openstack-sig, orabin, osapryki, oskutka, ovanders, pabelanger, pahickey, pantinor, pcreech, pdelbell, peholase, periklis, pjindal, pmackay, rcernich, rchan, relrod, rguimara, rpetrell, rrajasek, rstancel, scorneli, sdoran, slucidi, smaestri, smcdonal, sseago, stcannon, tkuratom, tojeline, tom.jenkinson, twalsh, tzimanyi, vkumar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | terser 4.8.1, terser 5.14.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was found in the terser package. Affected versions of this package are vulnerable to Regular expression denial of service (ReDoS) attacks, affecting system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-03 05:04:23 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2126278, 2126279, 2126280, 2126281, 2126282, 2126283, 2126284, 2126285, 2126310, 2126311, 2126312, 2126313, 2126314, 2126343, 2126344, 2126345, 2126346, 2126713, 2126715 | ||
| Bug Blocks: | 2126196 | ||
|
Description
Avinash Hanwate
2022-09-13 05:04:42 UTC
Created cockatrice tracking bugs for this issue: Affects: fedora-all [bug 2126279] Created golang-entgo-ent tracking bugs for this issue: Affects: fedora-all [bug 2126280] Created golang-github-prometheus tracking bugs for this issue: Affects: epel-7 [bug 2126278] Created grafana tracking bugs for this issue: Affects: fedora-all [bug 2126281] Created zuul tracking bugs for this issue: Affects: fedora-all [bug 2126282] This issue has been addressed in the following products: RHINT Service Registry 2.3.0 GA Via RHSA-2022:6835 https://access.redhat.com/errata/RHSA-2022:6835 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 Via RHSA-2022:7276 https://access.redhat.com/errata/RHSA-2022:7276 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 Via RHSA-2022:7313 https://access.redhat.com/errata/RHSA-2022:7313 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-25858 This issue has been addressed in the following products: Red Hat OpenShift Service Mesh 2.2 for RHEL 8 Via RHSA-2023:3645 https://access.redhat.com/errata/RHSA-2023:3645 |