Red Hat Bugzilla – Bug 1547272
CVE-2018-1109 nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js
Last modified: 2018-06-29 16:48:27 EDT
A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. It used a regular expression (^\{(,+(?:(\{,+\})*),*|,*(?:(\{,+\})*),+)\}) in order to detects empty braces. This can cause an impact of about 10 seconds matching time for data 50K characters long. Upstream Patch: https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451 External References: https://snyk.io/vuln/npm:braces:20180219
The 'braces' library is included in RHMAP, fh-ngui by the 'watchify' library. It doesn't accept user input to the string being matched by the vulnerable regular expression. Marking RHMAP as not affected.
NodeJS is shipped in Openshift Enterprise 3.9 as ImageStreams. Those ImageStreams are the RH Software Collection images. Setting Openshift Enterprise 3 as not affected.
The problematic regular expression was added as an optimization in version 2.2.0 via the following commit: https://github.com/micromatch/braces/commit/dcc1acab4de9a43e86ab4be4acde209ff1dca113 Therefore, this issue is not applicable to older braces versions.
The nodejs-braces was added to Fedora 28, using affected upstream version 2.2.2. Rawhide / F29 already has fixed upstream version 2.3.2.
Created nodejs-braces tracking bugs for this issue: Affects: fedora-28 [bug 1596764]