{
  "threat_severity" : "Moderate",
  "public_date" : "2021-06-28T00:00:00Z",
  "bugzilla" : {
    "description" : "npm-prismjs: a malicious (long) string will take a long time to highlight may result in ReDoS",
    "id" : "1980286",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1980286"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-400",
  "details" : [ "Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.", "A flaw was found in npm-prismjs. An attacker can craft a string that will take a  very long time to highlight when used to work with un-trusted text resulting in ReDoS.\nThis can affect the system availability. There is no known risk of privilege escalation on data compromise." ],
  "statement" : "In OpenShift Container Platform (OCP) the affected grafana container is behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-prismjs library to authenticated users only, therefore the impact is low.\nAdditionally, OCP 3.11 and OpenShift Service Mesh 1.1.x are in maintenance support for low and moderate impact vulnerabilities, hence the OCP 3.11 and OSSM 1.1 grafana containers have been set OOSS.",
  "package_state" : [ {
    "product_name" : "OpenShift Service Mesh 1",
    "fix_state" : "Out of support scope",
    "package_name" : "servicemesh-grafana",
    "cpe" : "cpe:/a:redhat:service_mesh:1"
  }, {
    "product_name" : "OpenShift Service Mesh 2.0",
    "fix_state" : "Affected",
    "package_name" : "servicemesh-grafana",
    "cpe" : "cpe:/a:redhat:service_mesh:2.0"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 3",
    "fix_state" : "Affected",
    "package_name" : "rox",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:3"
  }, {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Out of support scope",
    "package_name" : "grafana",
    "cpe" : "cpe:/a:redhat:ceph_storage:3"
  }, {
    "product_name" : "Red Hat Ceph Storage 4",
    "fix_state" : "Not affected",
    "package_name" : "rhceph/rhceph-4-dashboard-rhel8",
    "cpe" : "cpe:/a:redhat:ceph_storage:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Out of support scope",
    "package_name" : "openshift3/grafana",
    "cpe" : "cpe:/a:redhat:openshift:3.11",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift4/ose-grafana",
    "cpe" : "cpe:/a:redhat:openshift:4",
    "impact" : "low"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-32723\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-32723\nhttps://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg" ],
  "name" : "CVE-2021-32723",
  "mitigation" : {
    "value" : "As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text.",
    "lang" : "en:us"
  },
  "csaw" : false
}