CVE-2024-21538

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Root has patched CVE-2024-21538 in the @rootio/cross-spawn package for Root:npm. Multiple fixed versions available.

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 0.2.9-tuxcare.1.

TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 5.1.0-tuxcare.1.

TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 3.0.1-tuxcare.1.

TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 6.0.5-tuxcare.1.

TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 7.0.3-tuxcare.1.

These are all security issues fixed in the jupyter-nbclassic-1.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jupyter-jupyterlab-latex-4.1.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-furo-doc-2024.8.6-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-jupyter-ydoc-3.0.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jupyter-nbdime-7.0.2-18.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-pytest-html-4.1.1-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack22-22.12.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs18 fixes the following issues:

• CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency (bsc#1233856)

• Update to 18.20.5

  • esm: mark import attributes and JSON module as stable
  • deps:
    • upgrade npm to 10.8.2
    • update simdutf to 5.6.0
    • update brotli to 1.1.0
    • update ada to 2.8.0
    • update acorn to 8.13.0
    • update acorn-walk to 8.3.4
    • update c-ares to 1.29.0

This update for nodejs20 fixes the following issues:

• CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency (bsc#1233856)

Other fixes:

• Updated to 20.18.1:
  • Experimental Network Inspection Support in Node.js
  • Exposes X509_V_FLAG_PARTIAL_CHAIN to tls.createSecureContext
  • New option for vm.createContext() to create a context with a freezable globalThis
  • buffer: optimize createFromString
• Changes in 20.17.0:
  • module: support require()ing synchronous ESM graphs
  • path: add matchesGlob method
  • stream: expose DuplexPair API
• Changes in 20.16.0:
  • process: add process.getBuiltinModule(id)
  • inspector: fix disable async hooks on Debugger.setAsyncCallStackDepth
  • buffer: add .bytes() method to Blob

This update for nodejs20 fixes the following issues:

• CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency (bsc#1233856)

Other fixes:

• Updated to 20.18.1:
  • Experimental Network Inspection Support in Node.js
  • Exposes X509_V_FLAG_PARTIAL_CHAIN to tls.createSecureContext
  • New option for vm.createContext() to create a context with a freezable globalThis
  • buffer: optimize createFromString
• Changes in 20.17.0:
  • module: support require()ing synchronous ESM graphs
  • path: add matchesGlob method
  • stream: expose DuplexPair API
• Changes in 20.16.0:
  • process: add process.getBuiltinModule(id)
  • inspector: fix disable async hooks on Debugger.setAsyncCallStackDepth
  • buffer: add .bytes() method to Blob

This update for nodejs18 fixes the following issues:

• CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency (bsc#1233856)

Other fixes:

• Update to 18.20.5
  • esm: mark import attributes and JSON module as stable
  • deps:
    • upgrade npm to 10.8.2
    • update simdutf to 5.6.0
    • update brotli to 1.1.0
    • update ada to 2.8.0
    • update acorn to 8.13.0
    • update acorn-walk to 8.3.4
    • update c-ares to 1.29.0

This update for aws-cli, local-npm-registry, python-boto3, python-botocore, python-coverage, python-flaky, python-pluggy, python-pytest, python-pytest-cov, python-pytest-html, python-pytest-metadata, python-pytest-mock contains the following fixes:

Changes in aws-cli:

• Update to 1.33.26
  • api-change:acm-pca: Minor refactoring of C2J model for AWS Private CA
  • api-change:arc-zonal-shift: Adds the option to subscribe to get notifications when a zonal autoshift occurs in a region.
  • api-change:globalaccelerator: This feature adds exceptions to the Customer API to avoid throwing Internal Service errors
  • api-change:pinpoint: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:quicksight: Vega ally control options and Support for Reviewed Answers in Topics
• from version 1.33.25
  • api-change:batch: This feature allows AWS Batch Jobs with EKS container orchestration type to be run as Multi-Node Parallel Jobs.
  • api-change:bedrock: Add support for contextual grounding check for Guardrails for Amazon Bedrock.
  • api-change:bedrock-agent: Introduces new data sources and chunking strategies for Knowledge bases, advanced parsing logic using FMs, session summary generation, and code interpretation (preview) for Claude V3 Sonnet and Haiku models. Also introduces Prompt Flows (preview) to link prompts, foundational models, and resources.
  • api-change:bedrock-agent-runtime: Introduces query decomposition, enhanced Agents integration with Knowledge bases, session summary generation, and code interpretation (preview) for Claude V3 Sonnet and Haiku models. Also introduces Prompt Flows (preview) to link prompts, foundational models, and resources for end-to-end solutions.
  • api-change:bedrock-runtime: Add support for contextual grounding check and ApplyGuardrail API for Guardrails for Amazon Bedrock.
  • api-change:ec2: Add parameters to enable provisioning IPAM BYOIPv4 space at a Local Zone Network Border Group level
  • api-change:glue: Add recipe step support for recipe node
  • api-change:groundstation: Documentation update specifying OEM ephemeris units of measurement
  • api-change:license-manager-linux-subscriptions: Add support for third party subscription providers, starting with RHEL subscriptions through Red Hat Subscription Manager (RHSM). Additionally, add support for tagging subscription provider resources, and detect when an instance has more than one Linux subscription and notify the customer.
  • api-change:mediaconnect: AWS Elemental MediaConnect introduces the ability to disable outputs. Disabling an output allows you to keep the output attached to the flow, but stop streaming to the output destination. A disabled output does not incur data transfer costs.
• from version 1.33.24
  • api-change:datazone: This release deprecates dataProductItem field from SearchInventoryResultItem, along with some unused DataProduct shapes
  • api-change:fsx: Adds support for FSx for NetApp ONTAP 2nd Generation file systems, and FSx for OpenZFS Single AZ HA file systems.
  • api-change:opensearch: This release adds support for enabling or disabling Natural Language Query Processing feature for Amazon OpenSearch Service domains, and provides visibility into the current state of the setup or tear-down.
  • api-change:sagemaker: This release 1/ enables optimization jobs that allows customers to perform Ahead-of-time compilation and quantization. 2/ allows customers to control access to Amazon Q integration in SageMaker Studio. 3/ enables AdditionalModelDataSources for CreateModel action.
• from version 1.33.23
  • api-change:codedeploy: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:devicefarm: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:dms: Add v2 smoke…