PT-2018-4719 · Npm+1 · Minimatch+1

Published 2018-05-31 · Updated 2021-03-15 · CVE-2016-10540

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Minimatch versions 3.0.1 and earlier

Description The issue concerns a minimal matching utility that converts glob expressions into JavaScript RegExp objects. It is vulnerable to ReDoS in the pattern parameter of the primary function minimatch(path, pattern). This vulnerability can lead to regular expression denial of service attacks when user input is passed into the pattern argument.

Recommendations Update to version 3.0.2 or later. As a temporary workaround, consider restricting the use of the pattern parameter in the minimatch(path, pattern) function to minimize the risk of exploitation. Avoid using user input in the pattern argument until the issue is resolved.

Exploit

Fix

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

AZL-44502

CVE-2016-10540

GHSA-HXM2-R34F-QMC5

USN-4783-1

Affected Products

Minimatch

Ubuntu

References · 14

• 🔥 https://nodesecurity.io/advisories/118 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10540 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10540 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-10540 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4783-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10540 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10540 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10540 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hxm2-r34f-qmc5 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10540 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4783-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44502 · Vendor Advisory
• https://github.com/advisories/GHSA-hxm2-r34f-qmc5 · Note
• https://npmjs.com/advisories/118 · Note