Bug 1943976 (CVE-2017-16099) - CVE-2017-16099 nodejs-no-case: regular expression denial of service in no-case module
Summary: CVE-2017-16099 nodejs-no-case: regular expression denial of service in no-cas...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-16099
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-03-28 22:12 UTC by Jason Shepherd
Modified: 2021-04-01 09:23 UTC (History)
2 users (show)

Fixed In Version: nodejs-no-case-2.3.2
Clone Of:
Environment:
Last Closed: 2021-03-28 23:35:16 UTC
Embargoed:

Attachments (Terms of Use)

Description Jason Shepherd 2021-03-28 22:12:16 UTC 
The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition.
Comment 1 Jason Shepherd 2021-03-28 22:12:19 UTC 
Statement:

Red Hat Quay imports nodejs-no-case as a build time dependency of html-loader. Nodejs-no-case is only used as build time, and not at runtime.
Comment 2 Product Security DevOps Team 2021-03-28 23:35:16 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-16099
Note You need to log in before you can comment on or make changes to this bug.