Lucene search

K

RedhatCVELIST:CVE-2022-3517

HistoryOct 17, 2022 - 12:00 a.m.

CVE-2022-3517

2022-10-1700:00:00

CWE-400

redhat

www.cve.org

2

vulnerability

minimatch package

redos

braceexpand function

dos

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "minimatch",
    "versions": [
      {
        "version": "minimatch versions prior to 3.0.5",
        "status": "affected"
      }
    ]
  }
]

References

github.com/grafana/grafana-image-renderer/issues/329

github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6

lists.debian.org/debian-lts-announce/2023/01/msg00011.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

Related for CVELIST:CVE-2022-3517

nessus40 ibm17 debiancve1 redos1 osv16 openvas7 nvd1 debian1 ubuntucve1 cve1 prion1 ubuntu1 veracode1 github1 redhatcve1 almalinux6 oraclelinux6 rocky6 redhat13 fedora2