REDHAT-BUG-2494813: Low severity brace-expansion vulnerability
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate denial-of-service by limiting how untrusted input is allowed to reach the brace-expansion expand() function (e.g., reject or cap length/structure of crafted brace patterns that could cause exponential-time CPU consumption and event-loop blocking).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2494813?
The severity of REDHAT-BUG-2494813 is classified as low.
What type of vulnerability is described in REDHAT-BUG-2494813?
REDHAT-BUG-2494813 describes a denial of service vulnerability due to exponential-time complexity in the expand() function.
How does REDHAT-BUG-2494813 allow for denial of service?
REDHAT-BUG-2494813 allows for denial of service by processing crafted strings that lead to significant CPU consumption.
What is the affected software version for REDHAT-BUG-2494813?
The vulnerability in REDHAT-BUG-2494813 affects the brace-expansion software version 5.0.6 and below.
How can users mitigate REDHAT-BUG-2494813?
Users can mitigate REDHAT-BUG-2494813 by avoiding the use of untrusted input with the expand() function in brace-expansion.