The vulnerability of the micromatch library lies in the inefficient complexity of regular expressions, allowing attackers to trigger a service failure.

🗓️ 14 Nov 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

The micromatch vulnerability due to inefficient regular expressions can cause service failures.

Reporter	Title	Published	Views	Family All 118
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	8 Jul 202409:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in micromatch-4.0.5.tgz	7 Jul 202517:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to micromatch-4.0.5.tgz CVE-2024-4067	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to micromatch-4.0.5.tgz CVE-2024-4067	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is using components with known vulnerabilities	9 Jul 202417:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (February 2025)	15 Apr 202503:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Information Queue	5 Aug 202409:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Node.js micromatch & braces modules (CVE-2024-4067 & CVE-2024-4068)	14 Jun 202410:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation Fixes for June 2024.	29 Jan 202521:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway vulnerable to DoS due to Node.js micromatch module (CVE-2024-4067)	3 Sep 202414:18	–	ibm

Vulners

Node

red_hat jboss_enterprise_application_platformMatch7

OR

red_hat red_hat_jboss_data_gridMatch7

OR

red_hat red_hat_process_automationMatch7

OR

red_hat red_hat_3scale_api_management_platformMatch2

OR

red_hat red_hat_data_gridMatch8

OR

red_hat red_hat_satelliteMatch6

OR

red_hat cryostatMatch2

OR

red_hat red_hat_build_of_optaplannerMatch8

OR

red_hat red_hat_fuseMatch7

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

red_hat red_hat_enterprise_linuxMatch9

OR

fedora fedoraMatch39

OR

fedora fedoraMatch40

Source	Link
advisory	www.advisory.checkmarx.net/advisory/CVE-2024-4067/
devhub	www.devhub.checkmarx.com/cve-details/CVE-2024-4067/
github	www.github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
github	www.github.com/micromatch/micromatch/pull/266
github	www.github.com/micromatch/micromatch/releases/tag/4.0.8
redos	www.redos.red-soft.ru/support/secure/
linuxsecurity	www.linuxsecurity.com/advisories/fedora/fedora-39-yarnpkg-2024-d79685d847-security-advisory-updates-sr5zu722oijx
security-tracker	www.security-tracker.debian.org/tracker/CVE-2024-4067
access	www.access.redhat.com/security/cve/CVE-2024-4067
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-78df19aaf3

14 Nov 2024 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 25

CVSS 35.3

EPSS0.01429

micromatch inefficient regular expressions service failures vulnerability