[Bug 1893298] New: CVE-2020-7760 codemirror: ReDoS in tokenBase function in javascript.js
https://bugzilla.redhat.com/show_bug.cgi?id=1893298
Bug ID: 1893298 Summary: CVE-2020-7760 codemirror: ReDoS in tokenBase function in javascript.js Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: bmontgom@redhat.com, cmeyers@redhat.com, eparis@redhat.com, extras-orphan@fedoraproject.org, gblomqui@redhat.com, gmainwar@redhat.com, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jokerman@redhat.com, mabashia@redhat.com, mizdebsk@redhat.com, moceap@hotmail.com, msrb@redhat.com, notting@redhat.com, nstielau@redhat.com, rpetrell@redhat.com, smcdonal@redhat.com, sponnaga@redhat.com, viktor.vix.jancik@gmail.com Target Milestone: --- Classification: Other
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736c.... The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
Reference: https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
Upstream patch: https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae8...
https://bugzilla.redhat.com/show_bug.cgi?id=1893298
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1893301, 1893300
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1893300 [Bug 1893300] CVE-2020-7760 nodejs-codemirror: codemirror: ReDoS in tokenBase function in javascript.js [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1893301 [Bug 1893301] CVE-2020-7760 nodejs-codemirror: codemirror: ReDoS in tokenBase function in javascript.js [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1893298
Mark Cooper mcooper@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |codemirror 5.58.2
https://bugzilla.redhat.com/show_bug.cgi?id=1893298
--- Comment #2 from Mark Cooper mcooper@redhat.com --- External References:
https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
https://bugzilla.redhat.com/show_bug.cgi?id=1893298
--- Comment #3 from Mark Cooper mcooper@redhat.com --- Statement:
In OpenShift Container Platform (OCP) the Jenkins UI is by default behind OpenShift OAuth restricting access to the vulnerable codemirror library to authenticated users only, therefore the impact is Low.
https://bugzilla.redhat.com/show_bug.cgi?id=1893298
--- Comment #4 from Mark Cooper mcooper@redhat.com --- Statement:
In OpenShift Container Platform (OCP) the Jenkins web front end is by default behind OpenShift OAuth restricting access to the vulnerable codemirror library to authenticated users only, therefore the impact is Low.
https://bugzilla.redhat.com/show_bug.cgi?id=1893298
Mark Cooper mcooper@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Comment|0 |updated
--- Comment #0 has been edited ---
This affects the package codemirror between versions 5.32.0 to 5.58.1 inclusive; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736c.... The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
Reference: https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
Upstream patch: https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae8...
https://bugzilla.redhat.com/show_bug.cgi?id=1893298
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed| |2020-11-09 20:21:17
--- Comment #6 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-7760
https://bugzilla.redhat.com/show_bug.cgi?id=1893298 Bug 1893298 depends on bug 1893300, which changed state.
Bug 1893300 Summary: CVE-2020-7760 nodejs-codemirror: codemirror: ReDoS in tokenBase function in javascript.js [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1893300
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=1893298 Bug 1893298 depends on bug 1893301, which changed state.
Bug 1893301 Summary: CVE-2020-7760 nodejs-codemirror: codemirror: ReDoS in tokenBase function in javascript.js [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1893301
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com