The vulnerability of the comparison library with regular expressions containing ANSI escape codes (Ansi-regex) leads to uncontrolled resource consumption, allowing attackers to cause service failures.

🗓️ 17 Jan 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 12 Views

Vulnerability in a library using ANSI escape regexes causes resource exhaustion and service failures.

Reporter	Title	Published	Views	Family All 223
IBM Security Bulletins	Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	24 May 202218:37	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities in moment, ansi-regex, Node.js, and minimatch may affect IBM Spectrum Protect Client and IBM Spectrum Protect for Space Management (CVE-2022-31129, CVE-2022-24785, CVE-2021-3807, CVE-2022-29244, CVE-2022-3517)	17 Mar 202309:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus is vulnerable to denial of service due to ansi-regex module (CVE-2021-3807)	4 Jul 202216:16	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, OpenSSL, trim, and Chalk ansi-regex module might affect IBM Storage Defender – Data Protect	31 Oct 202316:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	30 Mar 202316:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	15 Jul 202516:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	20 Apr 202214:01	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	18 Oct 202213:51	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability found in Turf.js which is shipped with IBM® Intelligent Operations Center(CVE-2021-3807)	4 Sep 202312:22	–	ibm

Vulners

Node

OR

sindre_sorhus ansi-regexRange3.0.0–5.0.1

sindre_sorhus ansi-regexRange6.0.0–6.0.1

Source	Link
github	www.github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9
huntr	www.huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-3807
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-3807
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.3/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
web	www.web.nvd.nist.gov/view/vuln/detail

04 Apr 2024 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 37.5

CVSS 27.8

EPSS0.03552

library vulnerability regular expressions escape code regex resource exhaustion service failures