PT-2024-18951 · Eslint · @Eslint/Plugin-Kit

Rongchen Li · Published 2024-11-15 · Updated 2024-11-19 · CVE-2024-21539

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions @eslint/plugin-kit versions prior to 0.2.3

Description The issue is related to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability. Crafting a very large and well-crafted string can also increase the CPU usage and crash the program.

Recommendations For versions prior to 0.2.3, update to version 0.2.3 or later to resolve the issue. As a temporary workaround, consider restricting the input size to prevent large strings from being processed by the ConfigCommentParser function. Avoid using the ConfigCommentParser function with untrusted input until the issue is resolved.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-1333

CWE-770

Related Identifiers

CVE-2024-21539

GHSA-7Q7G-4XM8-89CQ

Affected Products

@Eslint/Plugin-Kit

References · 11

• https://osv.dev/vulnerability/CVE-2024-21539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21539 · Security Note
• https://osv.dev/vulnerability/GHSA-7q7g-4xm8-89cq · Vendor Advisory
• https://github.com/eslint/rewrite · Note
• https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf · Note
• https://github.com/eslint/rewrite/security/advisories/GHSA-7q7g-4xm8-89cq · Note
• https://t.me/latest_high_impact_cve/1530 · Telegram Post
• https://twitter.com/CVEnew/status/1858741181900882188 · Twitter Post
• https://t.me/cvenotify/102098 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627 · Note
• https://t.me/cvedetector/11433 · Telegram Post