axios is vulnerable to Inefficient Regular Expression Complexity

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - nodejs-axios: Regular expression denial of service in trim function (CVE-2021-3749)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of IBM Cognos Analytics installed on the remote host is affected by multiple vulnerabilities, including the following:

  - The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template     injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and     overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template     compilation). (CVE-2022-29078)

  - The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address     string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control     that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
    (CVE-2021-29418)

  - Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated     remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A     remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical     VPN or LAN hosts. (CVE-2021-28918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1276 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    This advisory covers the RPM packages for the release.

    Security Fix(es):

    * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

    * envoy: Incorrect configuration handling allows mTLS session re-use without re-validation     (CVE-2022-21654)

    * envoy: Incorrect handling of internal redirects to routes with a direct response entry (CVE-2022-21655)

    * istio: Unauthenticated control plane denial of service attack due to stack exhaustion (CVE-2022-24726)

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)

    * nodejs-axios: Regular expression denial of service in trim function (CVE-2021-3749)

    * ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)

    * golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet     (CVE-2021-29923)

    * golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

    * golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)

    * envoy: Null pointer dereference when using JWT filter safe_regex match (CVE-2021-43824)

    * envoy: Use-after-free when response filters increase response data (CVE-2021-43825)

    * envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826)

    * envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service (CVE-2022-23606)

    * istio: unauthenticated control plane denial of service attack (CVE-2022-23635)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199879	RHEL 7 : kiali (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
164652	IBM Cognos Analytics Multiple Vulnerabilities (6616285)	Nessus	CGI abuses	critical
159603	RHEL 8 : Red Hat OpenShift Service Mesh 2.0.9 (RHSA-2022:1276)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2021-3749

high

Tenable Plugins

high

critical

critical