Bug ID 1233863
Summary VUL-0: CVE-2024-21538: asar: cross-spawn: regular expression denial of service
Classification openSUSE
Product openSUSE Distribution
Version Leap 15.5
Hardware Other
URL https://smash.suse.de/issue/427356/
OS Other
Status NEW
Whiteboard CVSSv3.1:SUSE:CVE-2024-21538:5.5:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Severity Normal
Priority P5 - None
Component Security
Assignee brunopitrus@hotmail.com
Reporter andrea.mattiazzo@suse.com
QA Contact security-team@suse.de
Blocks 1233843
Target Milestone ---
Found By ---
Blocker ---

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular
Expression Denial of Service (ReDoS) due to improper input sanitization. An
attacker can increase the CPU usage and crash the program by crafting a very
large and well crafted string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21538
https://www.cve.org/CVERecord?id=CVE-2024-21538
https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff
https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f
https://github.com/moxystudio/node-cross-spawn/pull/160
https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349
https://bugzilla.redhat.com/show_bug.cgi?id=2324550
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/21xxx/CVE-2024-21538.json


You are receiving this mail because: