CVE-2021-35065: High severity node glob parent vulnerability
A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.
Other sources
glob-parent 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1.
This vulnerability is separate from GHSA-ww39-953v-wcq6.
— GitHub
Node.js glob-parent module is vulnerable to a denial of service, caused by an error in the enclosure regex. By sending a specially crafted string prepended with the letter "A", a remote attacker could exploit this vulnerability to cause a regular expression denial of service.
— IBM
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-35065.
What is the severity of CVE-2021-35065?
CVE-2021-35065 has a severity level of 7.5 (high).
What software is affected by CVE-2021-35065?
The following software is affected by CVE-2021-35065: glob-parent package (version up to 6.0.1), nodejs package (version up to 18-9020020230327152102.rhel9 or 1:16.19.1-1.el9_2), nodejs-nodemon package (version up to 0:2.0.20-3.el9_2), rh-sso7-keycloak package (version up to 0:18.0.6-1.redhat_00001.1.el7, el8, or el9), rh-nodejs14-nodejs package (version up to 0:14.21.1-3.el7), and rh-nodejs14-nodejs-nodemon package (version up to 0:2.0.20-2.el7).
What is the recommended remedy for CVE-2021-35065?
The recommended remedy for CVE-2021-35065 is to upgrade the affected software to the specific versions mentioned in the vulnerability details.
Are there any references for CVE-2021-35065?
Yes, here are some references for CVE-2021-35065: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/208298), [IBM Support](https://www.ibm.com/support/pages/node/6557106), [CVE Details](https://www.cve.org/CVERecord?id=CVE-2021-35065), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-35065), [Snyk](https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294).