Regular Expression Denial Of Service (ReDoS)

🗓️ 31 May 2024 05:28:55Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 141 Views

micromatch ReDoS vulnerabilit

Reporter	Title	Published	Views	Family All 125
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	8 Jul 202409:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in micromatch-4.0.5.tgz	7 Jul 202517:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to micromatch-4.0.5.tgz CVE-2024-4067	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to micromatch-4.0.5.tgz CVE-2024-4067	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is using components with known vulnerabilities	9 Jul 202417:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (February 2025)	15 Apr 202503:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Information Queue	5 Aug 202409:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Node.js micromatch & braces modules (CVE-2024-4067 & CVE-2024-4068)	14 Jun 202410:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation Fixes for June 2024.	29 Jan 202521:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway vulnerable to DoS due to Node.js micromatch module (CVE-2024-4067)	3 Sep 202414:18	–	ibm

Vulners

Node

node-micromatch node-micromatchMatch4.0.2+repack+~4.0.1-1debian

AND

debian debian_linuxMatch999

micromatch micromatchRange0.1.0–4.0.5js

micromatch micromatchRange0.1.0–4.0.7js

Source	Link
github	www.github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js
github	www.github.com/micromatch/micromatch/pull/247
github	www.github.com/micromatch/micromatch/issues/243
github	www.github.com/advisories/GHSA-952p-6rrq-rcjv
advisory	www.advisory.checkmarx.net/advisory/CVE-2024-4067/
devhub	www.devhub.checkmarx.com/cve-details/CVE-2024-4067/
github	www.github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
github	www.github.com/micromatch/micromatch/pull/266
github	www.github.com/micromatch/micromatch/releases/tag/4.0.8

31 May 2024 19:41Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.3

EPSS0.00176

SSVC