VDB
RHSA-2021%3A3024
RHSA-2021%3A3024
PUBLISHED
CVSS 7.5 HIGH
A regular expression denial of service (ReDoS) vulnerability was found in the npm library `ua-parser-js`. If a supplied user agent matches the `Noble` string and contains many spaces then the regex will conduct backtracking, taking an ever increasing amount of time depending on the number of spaces supplied. An attacker can use this vulnerability to potentially craft a malicious user agent resulting in a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | distributed-tracing/jaeger-ingester-rhel8@sha256:08d933c1abc89403e94199da7a473d42b753f6df9666c393960dfd7b38f255bd_s390x as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-ingester-rhel8@sha256:08d933c1abc89403e94199da7a473d42b753f6df9666c393960dfd7b38f255bd_s390x |
| Red Hat | distributed-tracing/jaeger-all-in-one-rhel8@sha256:9d271a288f1a1f5102863b7555eaafbc24f22a59f13ced48cd4370caeb2df343_ppc64le as a component of Red Hat OpenShift Jaeger 1.24 | * |
| Red Hat | distributed-tracing/jaeger-query-rhel8@sha256:87c8e391fb5f0fb9f64ad43b2ee341ca8ef5b8592cdd2fd7a7278e87a2c26f73_amd64 as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-query-rhel8@sha256:87c8e391fb5f0fb9f64ad43b2ee341ca8ef5b8592cdd2fd7a7278e87a2c26f73_amd64 |
| Red Hat | distributed-tracing/jaeger-all-in-one-rhel8@sha256:7d5af7217e9bf8929c444ae33246b11efdde65f07e6c097a1472d8e14de86352_amd64 as a component of Red Hat OpenShift Jaeger 1.24 | * |
| Red Hat | distributed-tracing/jaeger-collector-rhel8@sha256:87d78468016389498c470ff5c0cfae3e22acc1dd8ef055aceef44afa9ec6dae8_s390x as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-collector-rhel8@sha256:87d78468016389498c470ff5c0cfae3e22acc1dd8ef055aceef44afa9ec6dae8_s390x |
| Red Hat | distributed-tracing/jaeger-es-rollover-rhel8@sha256:ab83395c98e913252c6990d91d42dd670623afe32abde63c8ec93e2a715daabf_ppc64le as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-es-rollover-rhel8@sha256:ab83395c98e913252c6990d91d42dd670623afe32abde63c8ec93e2a715daabf_ppc64le |
| Red Hat | distributed-tracing/jaeger-agent-rhel8@sha256:a9ec7de569df87e84e1e3fc5ca499fcf8cdd90dd785088089dba1f864e4d6b88_amd64 as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-agent-rhel8@sha256:a9ec7de569df87e84e1e3fc5ca499fcf8cdd90dd785088089dba1f864e4d6b88_amd64 |
| Red Hat | distributed-tracing/jaeger-all-in-one-rhel8@sha256:fcdb2127f8a269f5f6beffb6fe028244455aac3a0886bc59ce56c666e88b1302_s390x as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-all-in-one-rhel8@sha256:fcdb2127f8a269f5f6beffb6fe028244455aac3a0886bc59ce56c666e88b1302_s390x |
| Red Hat | distributed-tracing/jaeger-query-rhel8@sha256:5575dca9092c9f1949b22fa165ecd03a910b59fe51d7d150e1d4ede43cc869d8_ppc64le as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-query-rhel8@sha256:5575dca9092c9f1949b22fa165ecd03a910b59fe51d7d150e1d4ede43cc869d8_ppc64le |
| Red Hat | distributed-tracing/jaeger-es-rollover-rhel8@sha256:01ca4015280a87e491da3f59e9c347a4b07f7a9faf352932a4acf9f3694806fb_amd64 as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-es-rollover-rhel8@sha256:01ca4015280a87e491da3f59e9c347a4b07f7a9faf352932a4acf9f3694806fb_amd64 |
| Red Hat | distributed-tracing/jaeger-query-rhel8@sha256:f5126af833eaaa79e3acc9f232274d0f9af50871bd8d6a8b4ca401854eb9d69e_s390x as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-query-rhel8@sha256:f5126af833eaaa79e3acc9f232274d0f9af50871bd8d6a8b4ca401854eb9d69e_s390x |
| Red Hat | distributed-tracing/jaeger-rhel8-operator@sha256:9f06fe997b00503643e5aeac74cc9ddbe5600b2710fa2ca7c40b83a97117c9ab_ppc64le as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-rhel8-operator@sha256:9f06fe997b00503643e5aeac74cc9ddbe5600b2710fa2ca7c40b83a97117c9ab_ppc64le |
| Red Hat | distributed-tracing/jaeger-es-rollover-rhel8@sha256:abf305acbcd3b1d6add81353fcc08ddf389cb38caf579ae3d1f3a9f506533f31_s390x as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-es-rollover-rhel8@sha256:abf305acbcd3b1d6add81353fcc08ddf389cb38caf579ae3d1f3a9f506533f31_s390x |
| Red Hat | distributed-tracing/jaeger-rhel8-operator@sha256:633b50d4922d3f97498e254e0f918bcbea56f86621218306964d4e3d6e5d636f_amd64 as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-rhel8-operator@sha256:633b50d4922d3f97498e254e0f918bcbea56f86621218306964d4e3d6e5d636f_amd64 |
| Red Hat | distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:a891a556ddc7010c809769a1f562e0836eb6b3b06b874ad2c67258c74c8a6b0d_s390x as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:a891a556ddc7010c809769a1f562e0836eb6b3b06b874ad2c67258c74c8a6b0d_s390x |
| Red Hat | distributed-tracing/jaeger-agent-rhel8@sha256:bdbef8098e1f49ec504c37fa088de7b56955b85ef7547aaab15ad9c48e42ba45_ppc64le as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-agent-rhel8@sha256:bdbef8098e1f49ec504c37fa088de7b56955b85ef7547aaab15ad9c48e42ba45_ppc64le |
| Red Hat | distributed-tracing/jaeger-agent-rhel8@sha256:735b306aa784be5c2fd25b8cb8e2acdb774b1219eefa694f98c096425e1e8de6_s390x as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-agent-rhel8@sha256:735b306aa784be5c2fd25b8cb8e2acdb774b1219eefa694f98c096425e1e8de6_s390x |
| Red Hat | distributed-tracing/jaeger-collector-rhel8@sha256:7ac829d0b5eeaf57a9d42a185c6e731d35532c16b8d5e9e2f51c2f811bc91b09_ppc64le as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-collector-rhel8@sha256:7ac829d0b5eeaf57a9d42a185c6e731d35532c16b8d5e9e2f51c2f811bc91b09_ppc64le |
| Red Hat | distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:fd243cd829d37fcc232afacf99060927902db9a21f31d4da5d5df547bdc15abd_amd64 as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:fd243cd829d37fcc232afacf99060927902db9a21f31d4da5d5df547bdc15abd_amd64 |
| Red Hat | distributed-tracing/jaeger-ingester-rhel8@sha256:c16b9e67b5b6cef8d23e3546c05db979b800752734a8b73c06ce49c9a6cf7db2_amd64 as a component of Red Hat OpenShift Jaeger 1.24 | distributed-tracing/jaeger-ingester-rhel8@sha256:c16b9e67b5b6cef8d23e3546c05db979b800752734a8b73c06ce49c9a6cf7db2_amd64 |
…and 4 more
Timeline
- Aug 9, 2021 CVE Published
- Mar 20, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2021:3024 advisory
- https://access.redhat.com/security/updates/classification/#low advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1940613 issue
- https://issues.redhat.com/browse/TRACING-2009 advisory
- https://issues.redhat.com/browse/TRACING-377 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3024.json advisory
- https://access.redhat.com/security/cve/CVE-2021-27292 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-27292 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-27292 advisory
- https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76 advisory