Bug 2310908 (CVE-2024-45296)

Summary: CVE-2024-45296 path-to-regexp: Backtracking regular expressions cause ReDoS
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aarif, aazores, adudiak, adupliak, ahanwate, akostadi, amasferr, amctagga, anjoseph, anli, anpicker, aprice, asoldano, aturgema, bbaranow, bdettelb, bmaxwell, boliveir, brian.stansberry, brking, caswilli, cbartlet, cdewolf, chazlett, cmiranda, danken, darran.lofthouse, dbosanac, dhanak, dholler, dkreling, dkuc, dmayorov, doconnor, dosoudil, drichtar, dsimansk, dymurray, eaguilar, ebaron, eric.wittmann, fdeutsch, fjansen, fjuma, gkamathe, gmalinko, gotiwari, gparvin, gtanzill, haoli, hasun, hkataria, ibek, ibolton, istudens, ivassile, iweiss, janstey, jcammara, jcantril, jchui, jhorak, jkang, jkoehler, jkoops, jlledo, jmatthew, jmitchel, jmontleo, jneedle, jowilson, jpallich, jprabhak, jreimann, jrokos, jsamir, jwendell, jwong, kaycoth, kingland, kshier, ktsao, kverlaen, lbainbri, lgao, mabashia, matzew, mdessi, michal.skrivanek, mjaros, mkleinhe, mmakovy, mnovotny, mosmerov, mperina, mpierce, mrizzi, msochure, msvehla, mulliken, mvyas, mwringe, nboldt, nipatil, njean, nwallace, nyancey, omaciel, ometelka, oramraz, owatkins, pahickey, pantinor, parichar, pbraun, pcattana, pcongius, pdelbell, pdrozd, peholase, pgaikwad, phoracek, pierdipi, pjindal, pmackay, pskopek, ptisnovs, rcernich, rguimara, rhaigner, rhuss, rjohnson, rkubis, rmartinc, rowaters, rstancel, rstepani, rtaniwa, saroy, sdawley, sfroberg, sgratch, simaishi, slucidi, smaestri, smcdonal, smullick, sseago, stcannon, sthorger, stirabos, syedriko, tasato, teagle, tfister, thavo, tjochec, tkral, tom.jenkinson, tpopela, twalsh, wtam, wzheng, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a denial of service (DoS).
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2311005, 2311007, 2311009, 2310984, 2310985, 2310986, 2310987, 2310988, 2310989, 2310990, 2310991, 2310992, 2310993, 2310994, 2310995, 2310996, 2310997, 2310998, 2310999, 2311000, 2311001, 2311002, 2311004, 2311006, 2311008, 2311010, 2311011    
Bug Blocks:    

Description OSIDB Bzimport 2024-09-09 19:20:42 UTC
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

Comment 2 errata-xmlrpc 2024-10-07 09:24:52 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Service Mesh 2.6 for RHEL 8
  Red Hat OpenShift Service Mesh 2.6 for RHEL 9

Via RHSA-2024:7726 https://access.redhat.com/errata/RHSA-2024:7726

Comment 3 errata-xmlrpc 2024-10-09 05:32:49 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2024:7599 https://access.redhat.com/errata/RHSA-2024:7599

Comment 4 errata-xmlrpc 2024-10-16 02:40:41 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2024:7922 https://access.redhat.com/errata/RHSA-2024:7922

Comment 5 errata-xmlrpc 2024-10-22 01:06:24 UTC
This issue has been addressed in the following products:

  NETWORK-OBSERVABILITY-1.7.0-RHEL-9

Via RHSA-2024:8014 https://access.redhat.com/errata/RHSA-2024:8014

Comment 6 errata-xmlrpc 2024-10-30 14:33:17 UTC
This issue has been addressed in the following products:

  RHODF-4.17-RHEL-9

Via RHSA-2024:8676 https://access.redhat.com/errata/RHSA-2024:8676

Comment 7 errata-xmlrpc 2024-11-25 18:24:35 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Dev Spaces 3 Containers

Via RHSA-2024:10236 https://access.redhat.com/errata/RHSA-2024:10236

Comment 8 errata-xmlrpc 2024-12-03 16:17:01 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 8
  Red Hat Ansible Automation Platform 2.4 for RHEL 9

Via RHSA-2024:10762 https://access.redhat.com/errata/RHSA-2024:10762

Comment 9 errata-xmlrpc 2024-12-10 01:37:49 UTC
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.8

Via RHSA-2024:10906 https://access.redhat.com/errata/RHSA-2024:10906

Comment 10 errata-xmlrpc 2024-12-12 20:00:37 UTC
This issue has been addressed in the following products:

  HawtIO 4.0.0 for Red Hat build of Apache Camel 4

Via RHSA-2024:11023 https://access.redhat.com/errata/RHSA-2024:11023

Comment 11 errata-xmlrpc 2025-01-08 11:31:30 UTC
This issue has been addressed in the following products:

  RHODF-4.16-RHEL-9

Via RHSA-2025:0082 https://access.redhat.com/errata/RHSA-2025:0082

Comment 12 errata-xmlrpc 2025-01-09 11:28:12 UTC
This issue has been addressed in the following products:

  RHODF-4.15-RHEL-9

Via RHSA-2025:0164 https://access.redhat.com/errata/RHSA-2025:0164

Comment 13 errata-xmlrpc 2025-01-15 01:19:58 UTC
This issue has been addressed in the following products:

  RHODF-4.14-RHEL-9

Via RHSA-2025:0323 https://access.redhat.com/errata/RHSA-2025:0323

Comment 14 errata-xmlrpc 2025-01-23 13:02:43 UTC
This issue has been addressed in the following products:

  RHOSS-1.35-RHEL-8

Via RHSA-2025:0664 https://access.redhat.com/errata/RHSA-2025:0664

Comment 16 errata-xmlrpc 2025-02-05 10:49:07 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2025:0875 https://access.redhat.com/errata/RHSA-2025:0875