The vulnerability of the minimatch library on the Node.js software platform allows a attacker to perform a type of attack known as “denial-of-service attack”.

🗓️ 22 May 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Minimatch for Node.js has a resource-exhaustion flaw enabling remote denial of service via regex.

Reporter	Title	Published	Views	Family All 206
IBM Security Bulletins	Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities	16 May 202420:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Marked, Minimatch and Logback might affect IBM Storage Defender Copy Data Management	26 Sep 202519:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile (Android) is affected by multiple vulnerabilities	21 Oct 202415:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to minimatch denial of service (CVE-2022-3517)	7 Dec 202220:26	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in minimatch may affect IBM Robotic Process Automation and result in a denial of service (CVE-2022-3517)	25 Jan 202320:41	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities in moment, ansi-regex, Node.js, and minimatch may affect IBM Spectrum Protect Client and IBM Spectrum Protect for Space Management (CVE-2022-31129, CVE-2022-24785, CVE-2021-3807, CVE-2022-29244, CVE-2022-3517)	17 Mar 202309:26	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:43	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in minimatch affects IBM Process Mining . CVE-2022-3517	1 Feb 202320:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	3 Jan 202413:16	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in node.js affect Cloud Pak Sytem [CVE-2023-28154, CVE-2022-46175, CVE-2022-3517]	29 Dec 202314:27	–	ibm

Vulners

Node

node.js node.jsRange<3.0.5

OR

fedora fedoraMatch36

OR

fedora fedoraMatch37

Source	Link
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-nodejs-minimatch-cve-2022-3517/
github	www.github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
lists	www.lists.debian.org/debian-lts-announce/2023/01/msg00011.html
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.7/
web	www.web.nvd.nist.gov/view/vuln/detail

13 Sep 2023 00:00Current

7High risk

Vulners AI Score7

CVSS 37.5

CVSS 27.8

EPSS0.01674

Minimatch Node platform Denial of service Regular expressions Remote attacker