CVE-2024-28176

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

CVSS 3.1 · 4.9 Medium EPSS 2.1% KEV · Not listed

Vendors

Fedoraproject Jose Project Redhat

Products

Fedora Jose Acm and 5 more

CVE-2024-28849

Proxy-Authorization header kept across hosts in follow-redirects

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Follow-redirects Project Redhat

Products

Follow-redirects Acm Advanced Cluster Security and 12 more

CVE-2024-28180

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

CVSS 3.1 · 4.3 Medium EPSS 2.0% KEV · Not listed

Vendors

Fedoraproject Go-jose Project Redhat

Products

Fedora Go-jose Acm and 12 more

CVE-2024-48949

elliptic: Missing Validation in Elliptic's EDDSA Signature Verification

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Indutny Redhat

Products

Elliptic Acm Multicluster Engine and 4 more

CVE-2024-42461

elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elliptic Project Redhat

Products

Elliptic Acm Multicluster Engine and 1 more

CVE-2024-42460

elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elliptic Project Indutny Redhat

Products

Elliptic Elliptic Acm and 2 more

CVE-2024-42459

elliptic: nodejs/elliptic: EDDSA signature malleability due to missing signature length check

In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elliptic Project Indutny Redhat

Products

Elliptic Elliptic Acm and 2 more

CVE-2023-37903

Sandbox Escape in vm2

vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.

CVSS 3.1 · 9.8 Critical EPSS 4.2% KEV · Not listed

Vendors

Redhat Vm2 Project

Products

Acm Multicluster Engine Vm2

CVE-2023-26159

follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Follow-redirects Redhat

Products

Follow Redirects Acm Cluster Observability Operator and 11 more

CVE-2022-31129

Inefficient Regular Expression Complexity in moment

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

CVSS 3.1 · 7.5 High EPSS 5.6% KEV · Not listed

Vendors

Debian Fedoraproject Momentjs and 1 more

Products

Debian Linux Fedora Moment and 14 more

CVE-2022-24785

Path Traversal in Moment.js

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

CVSS 3.1 · 7.5 High EPSS 13.8% KEV · Not listed

Vendors

Debian Fedoraproject Momentjs and 3 more

Products

Debian Linux Fedora Moment and 13 more

CVE-2021-3377

nodejs-ansi_up: XSS due to insufficient URL sanitization

The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.

CVSS 3.1 · 6.1 Medium EPSS 8.0% KEV · Not listed

Vendors

Ansi Up Project Redhat

Products

Ansi Up Acm

CVE-2021-23566

Information Exposure

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Nanoid Project Redhat

Products

Nanoid Acm Openshift and 1 more

CVE-2021-23358

Arbitrary Code Injection

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

CVSS 3.1 · 3.3 Low EPSS 4.2% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 2 more

Products

Debian Linux Fedora Acm and 3 more

CVE-2023-47108

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Opentelemetry Redhat

Products

Opentelemetry Acm Multicluster Engine and 3 more

CVE-2022-30631

Stack exhaustion when reading certain archives in compress/gzip

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Advanced Cluster Security and 18 more

CVE-2022-25883

nodejs-semver: Regular expression denial of service

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Npmjs Redhat

Products

Semver Acm Enterprise Linux and 7 more

CVE-2024-45801

Tampering by prototype polution in DOMPurify

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Cure53 Redhat

Products

Dompurify Acm Ansible Automation Platform and 5 more

CVE-2023-26136

tough-cookie: prototype pollution in cookie memstore

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

CVSS 3.1 · 6.5 Medium EPSS 2.6% KEV · Not listed

Vendors

Redhat Salesforce

Products

Acm Jboss Enterprise Application Platform Logging and 5 more

CVE-2023-49568

Maliciously crafted Git server replies can cause DoS on go-git clients

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go-git Project Redhat

Products

Go-git Acm Advanced Cluster Security and 7 more