CVE-2021-23343: Regular Expression Denial of Service (ReDoS)
A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Other sources
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
References: https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067 https://github.com/jbgutierrez/path-parse/issues/8
— Red Hat
path-parse is vulnerable to a denial of service. By sending a specially-crafted request via splitDeviceRe, splitTailRe, and splitPathRe regular expressions, a remote attacker could exploit this vulnerability to cause a regular expression denial of service (ReDoS).
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-nodejs14-nodejsto a version that resolves this vulnerability.Fixed in 0:14.17.5-1.el7 - Upgrade
Upgrade
redhat/rh-nodejs12-nodejsto a version that resolves this vulnerability.Fixed in 0:12.22.5-1.el7 - Upgrade
Upgrade
redhat/rh-nodejs12-nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:2.0.3-5.el7 - Upgrade
Upgrade
redhat/ovirt-engine-ui-extensionsto a version that resolves this vulnerability.Fixed in 0:1.2.7-1.el8e - Upgrade
Upgrade
redhat/path-parseto a version that resolves this vulnerability.Fixed in 1.0.7
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
CVE-2021-23343
What is the severity of CVE-2021-23343?
The severity of CVE-2021-23343 is medium with a CVSS score of 5.3.
Which software versions are affected by CVE-2021-23343?
All versions up to and including 1.0.7 of the path-parse package are affected. Additionally, versions 0:14.17.5-1.el7 and 0:12.22.5-1.el7 of rh-nodejs14-nodejs and rh-nodejs12-nodejs respectively are also affected.
How can an attacker exploit CVE-2021-23343?
An attacker can exploit CVE-2021-23343 by sending a specially-crafted request via certain regular expressions, causing a regular expression denial of service (ReDoS).
How can CVE-2021-23343 be fixed?
To fix CVE-2021-23343, it is recommended to update the path-parse package to version 1.0.8 or later. For rh-nodejs14-nodejs and rh-nodejs12-nodejs, update to versions 0:14.17.6-1.el7 and 0:12.22.6-1.el7 respectively.