PT-2022-24024 · Webpack+2 · Webpack Loader-Utils+2

Secdevlpr26 · Published 2022-10-14 · Updated 2025-12-11 · CVE-2022-37603

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions webpack loader-utils version 2.0.0 webpack loader-utils versions prior to 1.4.2 webpack loader-utils versions prior to 2.0.4 webpack loader-utils versions prior to 3.2.1

Description A Regular expression denial of service (ReDoS) flaw was found in the interpolateName function in interpolateName.js in webpack loader-utils via the url variable. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process.

Recommendations For version 2.0.0, update to version 2.0.4 or later to resolve the issue. For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue. For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the interpolateName function in interpolateName.js until a patch is applied. Avoid using the url variable in the affected interpolateName.js file until the issue is resolved.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2022-37603

GHSA-3RFM-JHWJ-7488

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

Affected Products

Confluence

Red Os

Webpack Loader-Utils

References · 26

• 🔥 https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107 · Exploit
• 🔥 https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3rfm-jhwj-7488 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37603 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-37603 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-37603 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-37603 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37603 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-37603 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-37603 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM · Vendor Advisory