Bug 2300499 (CVE-2024-41818)

Summary:	CVE-2024-41818 fast-xml-parser: ReDOS at currency parsing in currency.js
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, caswilli, cdaley, danken, dhanak, dholler, dkenigsb, dkuc, dsimansk, fdeutsch, fjansen, jchui, jkoehler, kaycoth, kingland, ktsao, kverlaen, matzew, mnovotny, nboldt, oramraz, phoracek, pierdipi, rguimara, rhuss, rjohnson, rtaniwa, smullick, stirabos, tkral
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A regular expression denial of service (ReDoS) flaw was found in fast-xml-parser in the currency.js script. By sending a specially crafted regex input, a remote attacker could cause a denial of service condition.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2301670, 2301671, 2301659, 2301660, 2301661, 2301672
Bug Blocks:

Description OSIDB Bzimport 2024-07-29 16:24:47 UTC

fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.

Comment 1 TEJ RATHI 2024-07-30 15:37:23 UTC

References:

[1] https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-mpg4-rc92-vx8v
[2] https://github.com/NaturalIntelligence/fast-xml-parser/commit/d0bfe8a3a2813a185f39591bbef222212d856164
[3] https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/src/v5/valueParsers/currency.js#L10

Comment 2 errata-xmlrpc 2024-08-06 16:21:27 UTC

This issue has been addressed in the following products:

  RHEL-9-CNV-4.16

Via RHSA-2024:5054 https://access.redhat.com/errata/RHSA-2024:5054

Comment 3 errata-xmlrpc 2024-09-18 11:57:11 UTC

This issue has been addressed in the following products:

  RHODF-4.16-RHEL-9

Via RHSA-2024:6755 https://access.redhat.com/errata/RHSA-2024:6755

Comment 5 errata-xmlrpc 2024-10-03 11:22:57 UTC

This issue has been addressed in the following products:

  RHODF-4.14-RHEL-9

Via RHSA-2024:7624 https://access.redhat.com/errata/RHSA-2024:7624

Comment 6 errata-xmlrpc 2024-10-30 14:29:21 UTC

This issue has been addressed in the following products:

  RHODF-4.17-RHEL-9

Via RHSA-2024:8676 https://access.redhat.com/errata/RHSA-2024:8676