Bug 1500705 (CVE-2017-16137) - CVE-2017-16137 nodejs-debug: Regular expression Denial of Service
Summary: CVE-2017-16137 nodejs-debug: Regular expression Denial of Service
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-16137
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1500706 1516739 1516740
Blocks: 1500709
TreeView+ depends on / blocked
 
Reported: 2017-10-11 11:10 UTC by Andrej Nemec
Modified: 2021-10-19 12:10 UTC (History)
39 users (show)

Fixed In Version: nodejs-debug 2.6.9, nodejs-debug 3.1.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-02-01 07:48:37 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3917 0 None None None 2021-10-19 12:10:03 UTC

Description Andrej Nemec 2017-10-11 11:10:00 UTC 
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Upstream issue:

https://github.com/visionmedia/debug/issues/501

Upstream pull request:

https://github.com/visionmedia/debug/pull/504
Comment 1 Andrej Nemec 2017-10-11 11:10:23 UTC 
Created nodejs-debug tracking bugs for this issue:

Affects: fedora-all [bug 1500706]
Comment 4 Mark Knowles 2017-11-23 10:46:44 UTC 
Created nodejs-debug tracking bugs for this issue:

Affects: openshift-1 [bug 1516740]
Comment 6 Jason Shepherd 2018-01-17 05:08:34 UTC 
debug formatters.o method not used in RHMAP. Marking as not affected.
Comment 9 Jason Shepherd 2021-05-07 01:43:31 UTC 
Statement:

This issue affects the versions of rh-nodejs4-nodejs-debug, rh-nodejs6-nodejs-debug, and rh-nodejs8-nodejs-debug as shipped with Red Hat Software Collections 3. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Red Hat Virtualization 4.2 EUS includes a vulnerable version of nodejs-debug as a part of the ovirt-engine-api-explorer package.  This package is removed in Red Hat Virtualization 4.3.

Red Hat Quay includes the debug library as a dependency of karma-webpack. It is only used at build time, and not runtime so its impact is reduce to low in Red Hat Quay.
Comment 10 errata-xmlrpc 2021-10-19 12:10:01 UTC 
This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917
Note You need to log in before you can comment on or make changes to this bug.