CVE-2024-27088: es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`
Impact
Passing functions with very long names or complex default argument names into function#copy orfunction#toStringTokens may put script to stall
Patches Fixed with https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2 and https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602 Published with v0.10.63
Workarounds No real workaround aside of refraining from using above utilities.
References https://github.com/medikoo/es5-ext/issues/201
Other sources
es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into function#copy or function#toStringTokens may cause the script to stall. The vulnerability is patched in v0.10.63.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/es5-extto a version that resolves this vulnerability.Fixed in 0.10.63 - Upgrade
Upgrade
medikoo/es5-extto a version that resolves this vulnerability.Fixed in v0.10.63 - Compensating control
Refrain from using `function#copy` and `function#toStringTokens` with functions that have very long names or complex default argument names, as passing such functions may cause the script to stall (workaround noted as “No real workaround aside of refraining from using above utilities.”).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27088?
CVE-2024-27088 has a high severity due to the potential for scripts to stall when processing long function names.
How do I fix CVE-2024-27088?
You can fix CVE-2024-27088 by updating the es5-ext package to version 0.10.63 or later.
Which versions of es5-ext are affected by CVE-2024-27088?
CVE-2024-27088 affects all versions of the es5-ext package from 0.10.0 up to 0.10.63.
Which IBM products are impacted by CVE-2024-27088?
IBM Planning Analytics Local - IBM Planning Analytics Workspace versions 2.0 and 2.1 are impacted by CVE-2024-27088.
What does CVE-2024-27088 vulnerability exploit?
CVE-2024-27088 exploits the ability of functions with long names or complex default argument names to stall scripts when processed.