https://bugzilla.redhat.com/show_bug.cgi?id=1893298
Bug ID: 1893298
Summary: CVE-2020-7760 codemirror: ReDoS in tokenBase function
in javascript.js
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: bmontgom(a)redhat.com, cmeyers(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
gblomqui(a)redhat.com, gmainwar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mabashia(a)redhat.com, mizdebsk(a)redhat.com,
moceap(a)hotmail.com, msrb(a)redhat.com,
notting(a)redhat.com, nstielau(a)redhat.com,
rpetrell(a)redhat.com, smcdonal(a)redhat.com,
sponnaga(a)redhat.com, viktor.vix.jancik(a)gmail.com
Target Milestone: ---
Classification: Other
This affects the package codemirror before 5.58.2; the package
org.apache.marmotta.webjars:codemirror before 5.58.2.
The vulnerable regular expression is located in
https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b7....
The ReDOS vulnerability of the regex is mainly due to the sub-pattern
(s|/*.*?*/)*
Reference:
https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
Upstream patch:
https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555...
--
You are receiving this mail because:
You are on the CC list for the bug.