CVE-2024-21538 Regular Expression Denial of Service (ReDoS) in cross-spawn
An attacker can cause a denial of service by crafting a large string that triggers excessive CPU usage in the cross-spawn library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21538?
CVE-2024-21538 is a high-severity denial of service vulnerability in cross-spawn, published on 8 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
Weakness: CWE-1333
Which versions are affected by CVE-2024-21538?
4 open source packages ship an affected version, including cross-spawn.
| Package | Affected | Fixed in |
|---|---|---|
cross-spawn npm | All versions | 6.0.6 |
cross-spawn npm | All versions | 6.0.6 |
cross-spawn npm | From 7.0.0 | 7.0.5 |
cross-spawn npm | From 7.0.0 | 7.0.5 |
Linux distribution packages (14)
nodejs18 SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 | All versions | 18.20.5-150400.9.30.1 |
nodejs20 SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 | All versions | 20.18.1-150500.11.15.1 |
nodejs20 SUSE:Linux Enterprise Module for Web and Scripting 15 SP6 | All versions | 20.18.1-150600.3.6.1 |
nodejs18 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 18.20.5-8.30.1 |
nodejs18 openSUSE:Leap 15.5 | All versions | 18.20.5-150400.9.30.1 |
nodejs20 openSUSE:Leap 15.5 | All versions | 20.18.1-150500.11.15.1 |
nodejs20 openSUSE:Leap 15.6 | All versions | 20.18.1-150600.3.6.1 |
jupyter-jupyterlab-latex openSUSE:Tumbleweed | All versions | 4.1.1-2.1 |
nodejs22 openSUSE:Tumbleweed | All versions | 22.12.0-1.1 |
python-furo openSUSE:Tumbleweed | All versions | 2024.8.6-2.1 |
python-jupyter-ydoc openSUSE:Tumbleweed | All versions | 3.0.0-2.1 |
python-nbclassic openSUSE:Tumbleweed | All versions | 1.1.0-2.1 |
python-nbdime openSUSE:Tumbleweed | All versions | 4.0.2-18.1 |
python-pytest-html openSUSE:Tumbleweed | All versions | 4.1.1-4.1 |
How do I fix CVE-2024-21538?
Upgrade cross-spawn to a fixed version for your release line: 6.0.6 or 7.0.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-21538 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21538 exists.
Sources
Also known as AZL-52548, AZL-52551, AZL-52561, AZL-52587, AZL-52604, BELL-CVE-2024-21538 and 24 more.