CVE-2020-28469: Regular Expression Denial of Service (ReDoS)
A flaw was found in nodejs-glob-parent. The enclosure regex used to check for glob enclosures containing backslashes is vulnerable to Regular Expression Denial of Service attacks. This flaw allows an attacker to cause a denial of service if they can supply a malicious string to the glob-parent function. The highest threat from this vulnerability is to system availability.
Other sources
Node.js glob-parent module is vulnerable to a denial of service. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a regular expression denial of service.
— IBM
The enclosure regex used to check for glob enclosures containing backslash is vulnerable to Regular Expression Denial of Service attacks. An attacker can use this flaw to cause a denial of service if they can supply a malicious string to the glob-parent function.
— Red Hat
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:2.0.19-1.el9_0 - Upgrade
Upgrade
redhat/rh-nodejs14-nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:2.0.3-5.el7 - Upgrade
Upgrade
redhat/rh-nodejs12-nodejsto a version that resolves this vulnerability.Fixed in 0:12.22.5-1.el7 - Upgrade
Upgrade
redhat/rh-nodejs12-nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:2.0.3-5.el7 - Upgrade
Upgrade
redhat/ovirt-engine-ui-extensionsto a version that resolves this vulnerability.Fixed in 0:1.2.7-1.el8e - Upgrade
Upgrade
redhat/ovirt-web-uito a version that resolves this vulnerability.Fixed in 0:1.7.2-1.el8e - Upgrade
Upgrade
npm/glob-parentto a version that resolves this vulnerability.Fixed in 5.1.2 - Upgrade
Upgrade
redhat/nodejs-glob-parentto a version that resolves this vulnerability.Fixed in 5.1.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-28469?
CVE-2020-28469 is a vulnerability in the package glob-parent before version 5.1.2. It is susceptible to Regular Expression Denial of Service (ReDoS) attacks.
How does CVE-2020-28469 impact the nodejs-glob-parent package?
CVE-2020-28469 allows an attacker to cause a denial of service by supplying a malicious string to the glob-parent function.
What is the severity of CVE-2020-28469?
CVE-2020-28469 has a severity rating of 7.5 (high).
How can I fix CVE-2020-28469?
To fix CVE-2020-28469, update the glob-parent package to version 5.1.2 or higher.
Where can I find more information about CVE-2020-28469?
You can find more information about CVE-2020-28469 at the following references: [CVE-2020-28469](https://www.cve.org/CVERecord?id=CVE-2020-28469), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-28469), [Snyk](https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1945459), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2021:3016).