Bug 1999784 (CVE-2021-3749) - CVE-2021-3749 nodejs-axios: Regular expression denial of service in trim function
Summary: CVE-2021-3749 nodejs-axios: Regular expression denial of service in trim func...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3749
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2000281 2000279 2000280 2000282 2000285 2001611 2001612 2001614 2002204 2006255 2006256 2008492 2008493 2008494 2008495 2008496 2008497 2008498 2020092 2020093 2020094
Blocks: 1999785
TreeView+ depends on / blocked
 
Reported: 2021-08-31 18:02 UTC by Pedro Sampaio
Modified: 2022-06-17 17:04 UTC (History)
52 users (show)

Fixed In Version: axios 0.21.2, axios 0.21.3
Doc Type: If docs needed, set a value
Doc Text:
A Regular Expression Denial of Service (ReDoS) vulnerability was found in the nodejs axios. This flaw allows an attacker to provide crafted input to the trim function, which might cause high resources consumption and as a consequence lead to denial of service. The highest threat from this vulnerability is system availability.
Clone Of:
Environment:
Last Closed: 2021-09-29 18:21:06 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3694 0 None None None 2021-09-29 14:34:36 UTC
Red Hat Product Errata RHSA-2021:4618 0 None None None 2021-11-11 18:32:33 UTC
Red Hat Product Errata RHSA-2021:4902 0 None None None 2021-12-01 17:24:09 UTC
Red Hat Product Errata RHSA-2022:0056 0 None None None 2022-03-10 16:01:56 UTC
Red Hat Product Errata RHSA-2022:1276 0 None None None 2022-04-07 17:59:01 UTC

Description Pedro Sampaio 2021-08-31 18:02:48 UTC 
axios is vulnerable to Inefficient Regular Expression Complexity in function isURLSearchParams in utils.js.

References:

https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31
Comment 4 Przemyslaw Roguski 2021-09-06 14:41:07 UTC 
the upstream fix:
https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
also back-ported to 0.21.2
Comment 12 errata-xmlrpc 2021-09-29 14:34:34 UTC 
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.6

Via RHSA-2021:3694 https://access.redhat.com/errata/RHSA-2021:3694
Comment 13 Product Security DevOps Team 2021-09-29 18:21:06 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3749
Comment 14 errata-xmlrpc 2021-11-11 18:32:30 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8

Via RHSA-2021:4618 https://access.redhat.com/errata/RHSA-2021:4618
Comment 15 errata-xmlrpc 2021-12-01 17:24:07 UTC 
This issue has been addressed in the following products:

  RHACS-3.67-RHEL-8

Via RHSA-2021:4902 https://access.redhat.com/errata/RHSA-2021:4902
Comment 16 errata-xmlrpc 2022-03-10 16:01:53 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.10

Via RHSA-2022:0056 https://access.redhat.com/errata/RHSA-2022:0056
Comment 17 errata-xmlrpc 2022-04-07 17:58:58 UTC 
This issue has been addressed in the following products:

  OpenShift Service Mesh 2.0

Via RHSA-2022:1276 https://access.redhat.com/errata/RHSA-2022:1276
Note You need to log in before you can comment on or make changes to this bug.