Bug 2300499 (CVE-2024-41818) - CVE-2024-41818 fast-xml-parser: ReDOS at currency parsing in currency.js
Summary: CVE-2024-41818 fast-xml-parser: ReDOS at currency parsing in currency.js
Keywords:
Status: NEW
Alias: CVE-2024-41818
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2301670 2301671 2301659 2301660 2301661 2301672
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-29 16:24 UTC by OSIDB Bzimport
Modified: 2025-05-06 08:28 UTC (History)
30 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:5054 0 None None None 2024-08-06 16:21:29 UTC
Red Hat Product Errata RHSA-2024:6755 0 None None None 2024-09-18 11:57:13 UTC
Red Hat Product Errata RHSA-2024:7624 0 None None None 2024-10-03 11:22:59 UTC
Red Hat Product Errata RHSA-2024:8676 0 None None None 2024-10-30 14:29:23 UTC

Description OSIDB Bzimport 2024-07-29 16:24:47 UTC 
fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.
Comment 1 TEJ RATHI 2024-07-30 15:37:23 UTC 
References:

[1] https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-mpg4-rc92-vx8v
[2] https://github.com/NaturalIntelligence/fast-xml-parser/commit/d0bfe8a3a2813a185f39591bbef222212d856164
[3] https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/src/v5/valueParsers/currency.js#L10
Comment 2 errata-xmlrpc 2024-08-06 16:21:27 UTC 
This issue has been addressed in the following products:

  RHEL-9-CNV-4.16

Via RHSA-2024:5054 https://access.redhat.com/errata/RHSA-2024:5054
Comment 3 errata-xmlrpc 2024-09-18 11:57:11 UTC 
This issue has been addressed in the following products:

  RHODF-4.16-RHEL-9

Via RHSA-2024:6755 https://access.redhat.com/errata/RHSA-2024:6755
Comment 5 errata-xmlrpc 2024-10-03 11:22:57 UTC 
This issue has been addressed in the following products:

  RHODF-4.14-RHEL-9

Via RHSA-2024:7624 https://access.redhat.com/errata/RHSA-2024:7624
Comment 6 errata-xmlrpc 2024-10-30 14:29:21 UTC 
This issue has been addressed in the following products:

  RHODF-4.17-RHEL-9

Via RHSA-2024:8676 https://access.redhat.com/errata/RHSA-2024:8676
Note You need to log in before you can comment on or make changes to this bug.