CVE-2021-23362

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression (regexp) function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process, potentially resulting in a denial of service.

While some components do package a vulnerable version of hosted-git-info, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:

• OpenShift Container Platform (OCP)
• OpenShift ServiceMesh (OSSM)
• Red Hat Advanced Cluster Management for Kubernetes (RHACM)

Specifically the following components:

• The OCP hive-container does ship the vulnerable component, however since OCP 4.6 the Metering product has been deprecated [1], set as wont-fix and may be fixed in a future release.

Red Hat Ceph Storage (RHCS) 4 packages a version of nodejs-hosted-git-info which is vulnerable to this flaw in the grafana-container shipped with it.

Red Hat Quay includes hosted-git-info as a dependency of karma-coverage which is only used at development time. The hosted-git-info library is not used at runtime so the impact is low for Red Hat Quay.

Red Hat Virtualization includes a vulnerable version of hosted-git-info, however it is only used during development. The hosted-git-info library is not used at runtime thus impact is rated Low and marked as "wontfix" at this time. Future updates may address this flaw.

[1] - https://access.redhat.com/solutions/5707561

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.