CVE-2022-25883

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the 'new Range' function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.

This vulnerability is rated Moderate for Red Hat Products versus NVD's High due to deployment context. The flaw in node-semver's new Range() function causes catastrophic regex backtracking on crafted input, leading to CPU exhaustion. However, exploitation requires untrusted input passed directly to the parser. So node-semver is a build-time dev dependency, not present in runtime environment in RHACM, and the functionality is additionally protected behind OAuth authentication, further limiting attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.