CVE-2024-21538: High severity IBM Edge Application Manager vulnerability
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
Other sources
Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21538?
CVE-2024-21538 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability.
How do I fix CVE-2024-21538?
To fix CVE-2024-21538, update the cross-spawn package to version 7.0.5 or later.
Which versions of cross-spawn are affected by CVE-2024-21538?
CVE-2024-21538 affects versions of the cross-spawn package prior to 7.0.5.
What can an attacker do with CVE-2024-21538?
An attacker can exploit CVE-2024-21538 to cause excessive CPU usage and potentially crash the application.
Is input sanitization relevant to CVE-2024-21538?
Yes, improper input sanitization is the root cause of the vulnerability in CVE-2024-21538.