| Summary: |
VUL-1: CVE-2016-1000023: nodejs: Regular expression denial-of-service |
| Product: |
[Novell Products] SUSE Security Incidents
|
Reporter: |
Johannes Segitz <jsegitz> |
| Component: |
Incidents | Assignee: |
Jordi Massaguer <jmassaguerpla> |
| Status: |
RESOLVED
FIXED
|
QA Contact: |
Security Team bot <security-team> |
| Severity: |
Normal
|
|
|
| Priority: |
P4 - Low
|
CC: |
qantas94heavy, smash_bz
|
| Version: |
unspecified | |
|
| Target Milestone: |
--- | |
|
| Hardware: |
Other | |
|
| OS: |
Other | |
|
| URL: |
https://smash.suse.de/issue/170967/
|
| Whiteboard: |
CVSSv2:RedHat:CVE-2016-1000023:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:SUSE:CVE-2016-1000023:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) |
|
Found By:
|
Security Response Team |
Services Priority:
|
|
|---|
|
Business Priority:
|
|
Blocker:
|
--- |
|---|
|
Marketing QA Status:
|
--- |
IT Deployment:
|
--- |
|---|
rh#1348509 Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) is vulnerable to ReDoS in the pattern parameter. This is because of the regular expression on line 521 of minimatch.js: /((?:\\{2})*)(\\?)\|/g,. The problematic portion of the regex is ((?:\\{2})*) which matches against //. Fix: https://github.com/isaacs/minimatch/commit/6944abf9e0694bd22fd9dad293faa40c2bc8a955 References: https://bugzilla.redhat.com/show_bug.cgi?id=1348509 https://nodesecurity.io/advisories/118 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000023 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1000023.html