CVE-2022-25758
Description
A flaw was found in the scss-tokenizer package. Affected versions of this package are vulnerable to a regular expression denial of service (ReDoS) attacks.
Statement
In OpenShift Service Mesh (OSSM) the vulnerable scss-tokenizer nodejs package is shipped in openshift-service-mesh/kiali-rhel8 and openshift-service-mesh/grafana-rhel8 container images. In the openshift-service-mesh/grafana-rhel8, the scss-tokenizer nodejs package is shipped as a part of the grafana rpm package, which is consumed from Red Hat Enterprise Linux (RHEL) repositories starting from OSSM 2.0.9 version. Once this vulnerability will be fixed in RHEL product, fixed version of grafana package will be consumed by OSSM and delivered in the next OSSM releases. In older versions than OSSM 2.0.9 the openshift-service-mesh/grafana-rhel8 container contains servicemesh-grafana rpm package from OSSM repositories and these versions are not supported anymore, hence the servicemesh-grafana rpm package is listed as affected with "Will not fix" state.
In OSSM openshift-service-mesh/kiali-rhel8 container image, the scss-tokenizer nodejs package is only listed as a development dependency, without impact to the runtime environment, hence is marked as "Will not fix".
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | 7.5 | 5.3 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | Low | High | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat CVSS v3 Score Explanation
To successfully exploit this vulnerability an attacker must be able to use "loadAnnotation()" function from the scss-tokenizer. Even successful attack won't generate the fully deny access to resources in the impacted component. Hence the Availability (A) metric is set to Low.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
