https://bugzilla.redhat.com/show_bug.cgi?id=2212561
Bug ID: 2212561
Summary: CVE-2022-3517 yarnpkg: nodejs-minimatch: ReDoS via the
braceExpand function [epel-all]
Product: Fedora EPEL
Version: epel9
Status: NEW
Component: yarnpkg
Keywords: Security, SecurityTracking
Severity: medium
Assignee: zsvetlik(a)redhat.com
Reporter: carl(a)redhat.com
CC: epel-packagers-sig(a)lists.fedoraproject.org,
extras-qa(a)fedoraproject.org, gsuckevi(a)redhat.com,
manisandro(a)gmail.com, ngompa13(a)gmail.com,
zsvetlik(a)redhat.com
Depends On: 2135472
Blocks: 2134609 (CVE-2022-3517,PRISMA-2022-0039)
Target Milestone: ---
Classification: Fedora
+++ This bug was initially created as a clone of Bug #2135472 +++
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2134609
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--- Additional comment from Guilherme de Almeida Suckevicz on 2022-10-17
16:52:32 UTC ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required)
type=security
# low, medium, high, urgent (required)
severity=medium
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=2134609,2135472
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
--- Additional comment from Fedora Update System on 2023-01-11 15:24:31 UTC ---
FEDORA-2023-ce8943223c has been submitted as an update to Fedora 37.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-ce8943223c
--- Additional comment from Fedora Update System on 2023-01-11 15:24:37 UTC ---
FEDORA-2023-18fd476362 has been submitted as an update to Fedora 36.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-18fd476362
--- Additional comment from Fedora Update System on 2023-01-12 02:41:58 UTC ---
FEDORA-2023-18fd476362 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh
--advisory=FEDORA-2023-18fd476362`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-18fd476362
See also
https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--- Additional comment from Fedora Update System on 2023-01-12 03:05:57 UTC ---
FEDORA-2023-ce8943223c has been pushed to the Fedora 37 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh
--advisory=FEDORA-2023-ce8943223c`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-ce8943223c
See also
https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--- Additional comment from Fedora Update System on 2023-01-21 03:30:45 UTC ---
FEDORA-2023-ce8943223c has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.
--- Additional comment from Fedora Update System on 2023-01-21 03:40:47 UTC ---
FEDORA-2023-18fd476362 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2134609
[Bug 2134609] CVE-2022-3517 nodejs-minimatch: ReDoS via the braceExpand
function
https://bugzilla.redhat.com/show_bug.cgi?id=2135472
[Bug 2135472] CVE-2022-3517 yarnpkg: nodejs-minimatch: ReDoS via the
braceExpand function [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212561