Security Bulletin: Denial of service, DNS poisoning, and information disclosure might affect IBM Storage Defender – Resiliency Service

Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in denial of service, DNS poisoning, and information disclosure. The vulnerabilities have been addressed. CVE-2024-34447, CVE-2024-30172, CVE-2024-30171, CVE-2024-29857, CVE-2024-45296, CVE-2023-44487, CVE-2024-29857...

path-to-regexp outputs backtracking regular expressions

...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.16 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

SUSE CVE-2024-45296

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

find-my-way has a ReDoS vulnerability in multiparametric routes

Impact A bad regular expression is generated any time you have two parameters within a single segment, when adding a - at the end, like /:a-:b-. Patches Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. Workarounds No known workarounds. References - CVE-2024-45296 - Detailed blog po...

GHSA-RRR8-F88R-H8Q6 find-my-way has a ReDoS vulnerability in multiparametric routes

Impact A bad regular expression is generated any time you have two parameters within a single segment, when adding a - at the end, like /:a-:b-. Patches Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. Workarounds No known workarounds. References - CVE-2024-45296 - Detailed blog po...

Denial Of Service (DoS)

path-to-regexp is vulnerable to Denial Of Service DoS. The vulnerability is due to the generation of inefficient regular expressions when path strings contain two parameters within a single segment separated by a non-period character, allowing an attacker to cause high CPU usage and potentially...

CVE-2024-45296

A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, po...

01-numacert (>=1.0.0, <=3.0.0), 05day (1.0.0) +14315 more potentially affected by CVE-2024-45296 via path-to-regexp (>=0.0.2, <=0.1.8)

path-to-regexp NPM version =0.0.2, =1.0.0, =1.0.1, =1.0.3, =0.2.0, =1.0.2, =1.0.0, =2.0.0, =0.2.0, =0.2.0, =0.2.3 and more Source cves: CVE-2024-45296 Source advisory: GHSA-9WV6-86V2-598J...

10chars-test (>=1.0.0, <=1.0.34), 128981semzub (1.0.1) +1470 more potentially affected by CVE-2024-45296 via path-to-regexp (>=0.2.5, <=1.8.0)

path-to-regexp NPM version =0.2.5, =1.0.0, =4.0.61, =4.0.61, =4.0.61, =0.0.3, =0.0.1, =1.1.11, =2.0.0, =0.0.1, =1.0.0, =3.3.9-patch.1, =3.0.0-beta.5, =3.0.3 and more Source cves: CVE-2024-45296 Source advisory: GHSA-9WV6-86V2-598J...

360shitu (0.1.0), 3d-crystal-model (0.1.0) +8400 more potentially affected by CVE-2024-45296 via path-to-regexp (>=2.0.0, <=3.2.0)

path-to-regexp NPM version =2.0.0, =0.24.0, =1.0.0, =1.0.6, =0.0.0-canary.1, =0.0.1, =6.1.5, =1.1.17, =1.2.151 - @21epub/pro-layout 6.10.9 and more Source cves: CVE-2024-45296 Source advisory: GHSA-9WV6-86V2-598J...

07-cesar-router (0.0.2), 07-custom-router (>=0.0.1, <=0.0.4) +1550 more potentially affected by CVE-2024-45296 via path-to-regexp (>=4.0.3, <=6.2.2)

path-to-regexp NPM version =4.0.3, =0.0.1, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.0, =0.0.1, =0.0.5, =0.0.1, =0.0.0-canary.0, =0.0.0-canary.6 and more Source cves: CVE-2024-45296 Source advisory: GHSA-9WV6-86V2-598J...

06-react-router-myself (>=0.0.1, <=0.0.2), 07-building-a-router (>=0.0.1, <=0.0.2) +196 more potentially affected by CVE-2024-45296 via path-to-regexp (>=7.0.0, <=7.2.0)

path-to-regexp NPM version =7.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =5.0.0, =2.13.21, =8.0.0, =4.0.34, =15.0.10, =4.0.0, =10.5.0, =0.0.9, =9.0.0, =9.5.0, =9.5.36 and more Source cves: CVE-2024-45296 Source advisory: GHSA-9WV6-86V2-598J...

10chars-test (>=1.0.0, <=1.0.34), 128981semzub (1.0.1) +1470 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=0.2.5, <=1.8.0)

path-to-regexp NPM version =0.2.5, =1.0.0, =4.0.61, =4.0.61, =4.0.61, =0.0.3, =0.0.1, =1.1.11, =2.0.0, =0.0.1, =1.0.0, =3.3.9-patch.1, =3.0.0-beta.5, =3.0.3 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...

06-react-router-myself (>=0.0.1, <=0.0.2), 07-building-a-router (>=0.0.1, <=0.0.2) +196 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=7.0.0, <=7.2.0)

path-to-regexp NPM version =7.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =5.0.0, =2.13.21, =8.0.0, =4.0.34, =15.0.10, =4.0.0, =10.5.0, =0.0.9, =9.0.0, =9.5.0, =9.5.36 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...

360shitu (0.1.0), 3d-crystal-model (0.1.0) +8400 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=2.0.0, <=3.2.0)

path-to-regexp NPM version =2.0.0, =0.24.0, =1.0.0, =1.0.6, =0.0.0-canary.1, =0.0.1, =6.1.5, =1.1.17, =1.2.151 - @21epub/pro-layout 6.10.9 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...

01-numacert (>=1.0.0, <=3.0.0), 05day (1.0.0) +14315 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=0.0.2, <=0.1.8)

path-to-regexp NPM version =0.0.2, =1.0.0, =1.0.1, =1.0.3, =0.2.0, =1.0.2, =1.0.0, =2.0.0, =0.2.0, =0.2.0, =0.2.3 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...

07-cesar-router (0.0.2), 07-custom-router (>=0.0.1, <=0.0.4) +1550 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=4.0.3, <=6.2.2)

path-to-regexp NPM version =4.0.3, =0.0.1, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.0, =0.0.1, =0.0.5, =0.0.1, =0.0.0-canary.0, =0.0.0-canary.6 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...

AZL-49103 CVE-2024-45296 affecting package js-jquery 3.5.0-4

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

AZL-49117 CVE-2024-45296 affecting package reaper for versions less than 3.1.1-13

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...