CVE-2021-3795

{"containers": {"cna": {"affected": [{"product": "sindresorhus/semver-regex", "vendor": "sindresorhus", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "3.1.3", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"status": "unaffected", "version": "3.1.3"}]}], "descriptions": [{"lang": "en", "value": "semver-regex is vulnerable to Inefficient Regular Expression Complexity"}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "description": "CWE-1333 Inefficient Regular Expression Complexity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-09-15T16:23:49.000Z", "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://huntr.dev/bounties/006624e3-35ac-448f-aab9-7b5183f30e28"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/sindresorhus/semver-regex/commit/11c66245f4e1976dccc52977ed183696a21a3fd7"}], "source": {"advisory": "006624e3-35ac-448f-aab9-7b5183f30e28", "discovery": "EXTERNAL"}, "title": "Inefficient Regular Expression Complexity in sindresorhus/semver-regex", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@huntr.dev", "ID": "CVE-2021-3795", "STATE": "PUBLIC", "TITLE": "Inefficient Regular Expression Complexity in sindresorhus/semver-regex"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "sindresorhus/semver-regex", "version": {"version_data": [{"version_affected": "<", "version_value": "4.0.1"}, {"version_affected": "<", "version_value": "3.1.3"}, {"version_affected": "!", "version_value": "3.1.3"}]}}]}, "vendor_name": "sindresorhus"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "semver-regex is vulnerable to Inefficient Regular Expression Complexity"}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-1333 Inefficient Regular Expression Complexity"}]}]}, "references": {"reference_data": [{"name": "https://huntr.dev/bounties/006624e3-35ac-448f-aab9-7b5183f30e28", "refsource": "CONFIRM", "url": "https://huntr.dev/bounties/006624e3-35ac-448f-aab9-7b5183f30e28"}, {"name": "https://github.com/sindresorhus/semver-regex/commit/11c66245f4e1976dccc52977ed183696a21a3fd7", "refsource": "MISC", "url": "https://github.com/sindresorhus/semver-regex/commit/11c66245f4e1976dccc52977ed183696a21a3fd7"}]}, "source": {"advisory": "006624e3-35ac-448f-aab9-7b5183f30e28", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:09:08.695Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://huntr.dev/bounties/006624e3-35ac-448f-aab9-7b5183f30e28"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/sindresorhus/semver-regex/commit/11c66245f4e1976dccc52977ed183696a21a3fd7"}]}]}, "cveMetadata": {"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "cveId": "CVE-2021-3795", "datePublished": "2021-09-15T16:23:49.000Z", "dateReserved": "2021-09-11T00:00:00.000Z", "dateUpdated": "2024-08-03T17:09:08.695Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "sindresorhus/semver-regex", "vendor": "sindresorhus", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "3.1.3", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"status": "unaffected", "version": "3.1.3"}]}], "source": "security@huntr.dev"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:semver-regex_project:semver-regex:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D108CA7-83E6-4F7D-948D-D0E798BCFDBE", "versionEndExcluding": "3.1.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:semver-regex_project:semver-regex:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "DDB55FE1-B64B-4E67-A89E-0D4FBF9ADE91", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "semver-regex is vulnerable to Inefficient Regular Expression Complexity"}, {"lang": "es", "value": "semver-regex es vulnerable a una Complejidad de Expresi\u00f3n Regular Ineficiente"}], "id": "CVE-2021-3795", "lastModified": "2026-06-17T04:05:47.033", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-09-15T17:15:10.577", "references": [{"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/sindresorhus/semver-regex/commit/11c66245f4e1976dccc52977ed183696a21a3fd7"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/006624e3-35ac-448f-aab9-7b5183f30e28"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/sindresorhus/semver-regex/commit/11c66245f4e1976dccc52977ed183696a21a3fd7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/006624e3-35ac-448f-aab9-7b5183f30e28"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security@huntr.dev", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1333"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "acmesolver-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "acm-must-gather-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "acm-operator-bundle-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "application-ui-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "cainjector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "cert-manager-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "cert-manager-webhook-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "cert-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "clusterlifecycle-state-metrics-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "configmap-watcher-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "config-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "console-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "console-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "console-header-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "endpoint-component-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "endpoint-monitoring-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "endpoint-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "governance-policy-propagator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "governance-policy-spec-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "governance-policy-status-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "governance-policy-template-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "grafana-dashboard-loader-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "grc-ui-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "grc-ui-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "iam-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "klusterlet-addon-lease-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "klusterlet-operator-bundle-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "kui-web-terminal-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "management-ingress-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "mcm-topology-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "mcm-topology-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "memcached-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "memcached-exporter-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "metrics-collector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicloud-manager-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multiclusterhub-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multiclusterhub-repo-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-observability-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-application-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-channel-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-deployable-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-placementrule-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-subscription-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-subscription-release-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "observatorium-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "observatorium-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "openshift-hive-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "rbac-query-proxy-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "rcm-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "redisgraph-tls-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "registration-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "registration-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-aggregator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-collector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-ui-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "submariner-addon-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "thanos-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "thanos-receive-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:3873", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "work-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-10-14T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "acmesolver-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "acm-must-gather-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "acm-operator-bundle-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "application-ui-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "cainjector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "cert-manager-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "cert-manager-webhook-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "cert-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "clusterlifecycle-state-metrics-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "configmap-watcher-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "config-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "console-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "console-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "console-header-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "endpoint-component-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "endpoint-monitoring-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "endpoint-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "governance-policy-propagator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "governance-policy-spec-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "governance-policy-status-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "governance-policy-template-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "grafana-dashboard-loader-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "grc-ui-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "grc-ui-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "iam-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "klusterlet-addon-lease-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "klusterlet-operator-bundle-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "kui-web-terminal-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "management-ingress-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "mcm-topology-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "mcm-topology-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "memcached-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "memcached-exporter-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "metrics-collector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicloud-manager-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multiclusterhub-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multiclusterhub-repo-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-observability-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-application-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-channel-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-deployable-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-placementrule-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-subscription-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "multicluster-operators-subscription-release-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "observatorium-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "observatorium-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "openshift-hive-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "rbac-query-proxy-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "rcm-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "redisgraph-tls-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "registration-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "registration-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-aggregator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-collector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "search-ui-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "submariner-addon-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "thanos-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "thanos-receive-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}, {"advisory": "RHSA-2021:5038", "cpe": "cpe:/a:redhat:acm:2.2::el7", "package": "work-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2021-12-09T00:00:00Z"}], "bugzilla": {"description": "semver-regex: inefficient regular expression complexity", "id": "2006009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2006009"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-400", "details": ["semver-regex is vulnerable to Inefficient Regular Expression Complexity", "A flaw was found in the semver-regex library where it could lead to consuming a big amount of resources when executing specific strings. Attackers could take advantage of this by crafting an invalid version causing a disruption or a denial of service (DoS)."], "name": "CVE-2021-3795", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "impact": "low", "package_name": "rhacm2/console-api-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "impact": "low", "package_name": "rhacm2/search-api-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:directory_server:11", "fix_state": "Not affected", "package_name": "redhat-ds:11/389-ds-base", "product_name": "Red Hat Directory Server 11"}, {"cpe": "cpe:/o:redhat:rhev_hypervisor:4", "fix_state": "Will not fix", "impact": "low", "package_name": "ovirt-engine-ui-extensions", "product_name": "Red Hat Virtualization 4"}, {"cpe": "cpe:/o:redhat:rhev_hypervisor:4", "fix_state": "Will not fix", "impact": "low", "package_name": "ovirt-web-ui", "product_name": "Red Hat Virtualization 4"}], "public_date": "2021-09-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-3795\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-3795"], "statement": "The Red Hat Directory Server 11 Web UI semver-regex as a dependency, but it is not used in the 389-ds cockpit plugin, and not shipped as part of the RPM binary. Thus Red Hat Directory Server 11 is not affected by this flaw.\nIn Red Hat Virtualization semver-regex is a dependency of semantic-release, which is used for release automation. The vulnerability may cause a denial of service during the release process of the components using the semantic-release package, and not their functionality. As such, the impact of this vulnerability for Red Hat Virtualization is rated Low and will not be addressed immediately. Future releases may include fixes.\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM) the server-regexp dependency is protected by OAuth what is reducing impact by this flaw to Low.", "threat_severity": "Moderate"}

{}