Bug 1941471 (CVE-2021-27290) - CVE-2021-27290 nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode
Summary: CVE-2021-27290 nodejs-ssri: Regular expression DoS (ReDoS) when parsing malic...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-27290
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1941472 1945285 1945286 1945287 1945288 1945289 1945290 1945299 1945300 1945301 1945302 1945303 1945304 1945305 1981756 1981758 1991578 1991579 1991580 1991581 1991582 1991583
Blocks: 1941473
TreeView+ depends on / blocked
 
Reported: 2021-03-22 08:48 UTC by Marian Rehak
Modified: 2023-08-31 23:48 UTC (History)
57 users (show)

Fixed In Version: ssri 8.0.1, ssri 7.1.1, ssri 6.0.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service (ReDoS). This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability.
Clone Of:
Environment:
Last Closed: 2021-07-28 13:06:48 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2931 0 None None None 2021-07-28 08:32:35 UTC
Red Hat Product Errata RHSA-2021:2932 0 None None None 2021-07-28 08:35:59 UTC
Red Hat Product Errata RHSA-2021:3073 0 None None None 2021-08-10 13:56:35 UTC
Red Hat Product Errata RHSA-2021:3074 0 None None None 2021-08-10 13:57:05 UTC
Red Hat Product Errata RHSA-2021:3638 0 None None None 2021-09-22 09:00:35 UTC
Red Hat Product Errata RHSA-2021:3639 0 None None None 2021-09-22 08:51:17 UTC

Description Marian Rehak 2021-03-22 08:48:16 UTC 
Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

Reference:

https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf
Comment 1 Marian Rehak 2021-03-22 08:48:46 UTC 
Created nodejs-ssri tracking bugs for this issue:

Affects: fedora-all [bug 1941472]
Comment 2 Tomas Hoger 2021-03-22 10:57:52 UTC 
The issue was fixed upstream in version 8.0.1 via this commit:

https://github.com/npm/ssri/commit/76e223317d971

The Donyensec advisory also notes that the issue was introduced in version 5.2.2 via the following commit aimed to address CVE-2018-7651:

https://github.com/npm/ssri/commit/d0ebcdc
Comment 15 Stoyan Nikolov 2021-04-22 15:53:25 UTC 
Statement:

Whilst the OpenShift ServiceMesh (OSSM) servicemesh-grafana and servicemesh-prometheus include the vulnerable ssri library, the vulnerable "strict" option is not used. Similar to OSSM, OpenShift Container Platform (OCP) or Red Hat Advance Cluster Management for Kubernetes (RHACM) components include the vulnerable ssri library but the "strict" option is not used. Additionally access to the vulnerable library is protected by OpenShift OAuth what reducing impact by this flaw to LOW. Therefore these OSSM, OCP and RHACM components have been marked as wont-fix and may be addressed in a future updates.

Red Hat Virtualization includes ssri in cockpit-ovirt, ovirt-web-ui and ovirt-engine-ui-extensions, but the vulnerable "strict" option is not used. Additionally access to the vulnerable library is protected by RHV authentication. Therefore  the impact of this flaw for RHV has been reduced to LOW and components have been marked as wont-fix and may be addressed in a future update.

Red Hat Quay includes ssri as a dependency of webpack which is only used at build time. The library is not used at runtime, reducing the impact of this vulnerability to low.
Comment 17 errata-xmlrpc 2021-07-28 08:32:17 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:2931 https://access.redhat.com/errata/RHSA-2021:2931
Comment 18 errata-xmlrpc 2021-07-28 08:35:48 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:2932 https://access.redhat.com/errata/RHSA-2021:2932
Comment 19 Product Security DevOps Team 2021-07-28 13:06:48 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27290
Comment 20 errata-xmlrpc 2021-08-10 13:56:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3073 https://access.redhat.com/errata/RHSA-2021:3073
Comment 21 errata-xmlrpc 2021-08-10 13:57:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3074 https://access.redhat.com/errata/RHSA-2021:3074
Comment 22 errata-xmlrpc 2021-09-22 08:51:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:3639 https://access.redhat.com/errata/RHSA-2021:3639
Comment 23 errata-xmlrpc 2021-09-22 09:00:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3638 https://access.redhat.com/errata/RHSA-2021:3638
Note You need to log in before you can comment on or make changes to this bug.