Vulnerability Name:

CVE-2021-33502 (CCN-202299)

Assigned:2021-05-21
Published:2021-05-21
Updated:2021-10-26
Summary:The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-Other
CWE-400
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2021-33502

Source: XF
Type: UNKNOWN
nodejs-cve202133502-dos(202299)

Source: CCN
Type: normalize-url GIT Repository
normalize-url

Source: CONFIRM
Type: Release Notes, Third Party Advisory
https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210706-0001/

Source: CCN
Type: IBM Security Bulletin 6466333 (Cloud Transformation Advisor)
IBM Cloud Transformation Advisor is affected by Node.js vulnerability

Source: CCN
Type: IBM Security Bulletin 6469445 (App Connect Enterprise Certified Container)
IBM App Connect Enterprise Certified Container may be affected by a ReDoS flaw when processing URLs (CVE-2021-33502)

Source: CCN
Type: IBM Security Bulletin 6491127 (Security Guardium Insights)
IBM Security Guardium Insights is affected by multiple vulnerabilities (CVE-2021-3538, CVE-2021-33502, CVE-2021-3450, CVE-2021-3449)

Source: CCN
Type: IBM Security Bulletin 6525034 (Spectrum Protect Plus)
Vulnerabilities in Node.js, Color-String, and PostgreSQL affect IBM Spectrum Protect Plus

Source: CCN
Type: IBM Security Bulletin 6573633 (QRadar Use Case Manager)
IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6574033 (Process Mining)
Vulnerability in Node.js normalize-url affects IBM Process Mining (CVE-2021-33502)

Source: CCN
Type: IBM Security Bulletin 6575667 (Spectrum Discover)
High severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)

Source: CCN
Type: IBM Security Bulletin 6589581 (Security QRadar Analyst Workflow)
Node.js as used by IBM Security QRadar Analyst Workflow App for IBM QRadar SIEM is vulnerable to multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6590981 (QRadar Data Synchronization App)
IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6612727 (Cloud Pak System Software)
Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System

Source: CCN
Type: IBM Security Bulletin 6830017 (QRadar Pulse App)
QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6890669 (Sterling External Authentication Server)
Multiple vulnerabilities affect IBM Sterling External Authentication Server

Source: CCN
Type: IBM Security Bulletin 6991645 (Edge Application Manager)
Open Source Dependency Vulnerability

Source: CCN
Type: NPM Web site
normalize-url

Vulnerable Configuration:Configuration 1:
  • cpe:/a:normalize-url_project:normalize-url:*:*:*:*:*:node.js:*:* (Version >= 4.3.0 and < 4.5.1)
  • OR cpe:/a:normalize-url_project:normalize-url:*:*:*:*:*:node.js:*:* (Version >= 5.0.0 and < 5.3.1)
  • OR cpe:/a:normalize-url_project:normalize-url:6.0.0:*:*:*:*:node.js:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:9:*:*:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/a:redhat:enterprise_linux:9::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_qradar_analyst_workflow:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:sterling_external_authentication_server:6.1.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20226595
    P
    		RHSA-2022:6595: nodejs and nodejs-nodemon security and bug fix update (Moderate)
    2022-09-20
    oval:com.redhat.rhsa:def:20220350
    P
    		RHSA-2022:0350: nodejs:14 security, bug fix, and enhancement update (Moderate)
    2022-02-01
    oval:com.redhat.rhsa:def:20215171
    P
    		RHSA-2021:5171: nodejs:16 security, bug fix, and enhancement update (Moderate)
    2021-12-16
    BACK
    normalize-url_project normalize-url *
    normalize-url_project normalize-url *
    normalize-url_project normalize-url 6.0.0
    nodejs node.js *
    ibm app connect enterprise 1.0.0
    ibm app connect enterprise 1.0.1
    ibm app connect enterprise 1.0.2
    ibm app connect enterprise 1.0.3
    ibm security qradar analyst workflow 1.0
    ibm sterling external authentication server 6.1.0