Bug 1939103 (CVE-2021-28092) - CVE-2021-28092 nodejs-is-svg: ReDoS via malicious string
Summary: CVE-2021-28092 nodejs-is-svg: ReDoS via malicious string
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-28092
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1942069 1942618 1942619 1942620 1942621 1944276 1944277 1945283 1945284 1946286
Blocks: 1939105
TreeView+ depends on / blocked
 
Reported: 2021-03-15 16:08 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-08-31 23:45 UTC (History)
28 users (show)

Fixed In Version: nodejs-is-svg 4.2.2
Clone Of:
Environment:
Last Closed: 2021-05-04 20:33:38 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 22:32:00 UTC
Red Hat Product Errata RHSA-2021:2461 0 None None None 2021-06-16 19:28:08 UTC
Red Hat Product Errata RHSA-2021:3016 0 None None None 2021-08-06 00:50:36 UTC
Red Hat Product Errata RHSA-2021:3759 0 None None None 2021-10-18 17:28:25 UTC

Description Guilherme de Almeida Suckevicz 2021-03-15 16:08:49 UTC 
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.

Reference:
https://github.com/sindresorhus/is-svg/releases/tag/v4.2.2

Upstream patch:
https://github.com/sindresorhus/is-svg/commit/01f8a087fab8a69c3ac9085fbb16035907ab6a5b
Comment 9 Jason Shepherd 2021-04-06 00:41:48 UTC 
Statement:

Red Hat OpenShift Container Platform (RHOCP) 4 delivers the kibana package where the nodejs-is-svg package is bundled, but during the update to container first (to openshift4/ose-logging-kibana6 since OCP 4.5) the dependency was removed and hence kibana package is marked as wontfix. This may be fixed in the future.

In OpenShift ServiceMesh (OSSM) and Red Hat OpenShift Container Platform (RHOCP) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable nodejs-is-svg to authenticated users only, therefore the impact is low.

Red Hat Quay includes is-svg as a dependency of css-loader which is only using during development, not runtime. This issues has been rated low impact for Red Hat Quay.
Comment 11 errata-xmlrpc 2021-05-04 20:14:46 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8
  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7

Via RHSA-2021:1499 https://access.redhat.com/errata/RHSA-2021:1499
Comment 12 Product Security DevOps Team 2021-05-04 20:33:38 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-28092
Comment 13 errata-xmlrpc 2021-06-16 19:28:02 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8
  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7

Via RHSA-2021:2461 https://access.redhat.com/errata/RHSA-2021:2461
Comment 14 errata-xmlrpc 2021-07-27 22:32:02 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438
Comment 15 errata-xmlrpc 2021-08-06 00:50:33 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 7
  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8

Via RHSA-2021:3016 https://access.redhat.com/errata/RHSA-2021:3016
Comment 18 errata-xmlrpc 2021-10-18 17:28:22 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.9

Via RHSA-2021:3759 https://access.redhat.com/errata/RHSA-2021:3759
Note You need to log in before you can comment on or make changes to this bug.