CVE-2022-37599 (High) detected in loader-utils-2.0.2.tgz

[mend-for-github-com]

CVE-2022-37599 - High Severity Vulnerability

Vulnerable Library - loader-utils-2.0.2.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.2.tgz

Dependency Hierarchy:

• @osd/pm-1.0.0.tgz (Root Library)
  • babel-loader-8.2.4.tgz
    • ❌ loader-utils-2.0.2.tgz (Vulnerable Library)

Found in HEAD commit: cba076465f44b6a819e3cff7986ff4cd21a66371

Found in base branch: main

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.

Publish Date: 2022-10-11

URL: CVE-2022-37599

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

[ananzh]

yarn why v1.22.19
[1/4] Why do we have the module "loader-utils"...?
[2/4] Initialising dependency graph...
warning @osd/ui-framework > node-sass > [email protected]: request has been deprecated, see https://github.com/request/request/issues/3142
warning Resolution field "[email protected]" is incompatible with requested version "typescript@~4.5.2"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "[email protected]"
info Has been hoisted to "loader-utils"
info Reasons this module exists
   - "workspace-aggregator-d947fd37-8c47-409d-924d-a97ac8a92719" depends on it
   - Hoisted from "_project_#@osd#interpreter#babel-loader#loader-utils"
   - Hoisted from "_project_#@osd#interpreter#copy-webpack-plugin#loader-utils"
   - Hoisted from "_project_#@osd#interpreter#css-loader#loader-utils"
   - Hoisted from "_project_#@osd#ui-shared-deps#mini-css-extract-plugin#loader-utils"
   - Hoisted from "_project_#@osd#optimizer#postcss-loader#loader-utils"
   - Hoisted from "_project_#@osd#ace#raw-loader#loader-utils"
   - Hoisted from "_project_#@osd#interpreter#sass-loader#loader-utils"
   - Hoisted from "_project_#@osd#interpreter#style-loader#loader-utils"
info Disk size without dependencies: "392KB"
info Disk size with unique dependencies: "656KB"
info Disk size with transitive dependencies: "760KB"
info Number of shared dependencies: 4
=> Found "@osd/ui-shared-deps#[email protected]"
info This module exists because "_project_#@osd#ui-shared-deps" depends on it.
info Disk size without dependencies: "84KB"
info Disk size with unique dependencies: "348KB"
info Disk size with transitive dependencies: "452KB"
info Number of shared dependencies: 4
=> Found "@osd/optimizer#[email protected]"
info This module exists because "_project_#@osd#optimizer" depends on it.
info Disk size without dependencies: "84KB"
info Disk size with unique dependencies: "348KB"
info Disk size with transitive dependencies: "452KB"
info Number of shared dependencies: 4
=> Found "val-loader#[email protected]"
info This module exists because "_project_#@osd#ui-shared-deps#val-loader" depends on it.
info Disk size without dependencies: "84KB"
info Disk size with unique dependencies: "348KB"
info Disk size with transitive dependencies: "452KB"
info Number of shared dependencies: 4
=> Found "file-loader#[email protected]"
info This module exists because "_project_#@osd#optimizer#file-loader" depends on it.
info Disk size without dependencies: "84KB"
info Disk size with unique dependencies: "348KB"
info Disk size with transitive dependencies: "452KB"
info Number of shared dependencies: 4
=> Found "string-replace-loader#[email protected]"
info This module exists because "_project_#@osd#pm#string-replace-loader" depends on it.
info Disk size without dependencies: "84KB"
info Disk size with unique dependencies: "348KB"
info Disk size with transitive dependencies: "452KB"
info Number of shared dependencies: 4
=> Found "url-loader#[email protected]"
info This module exists because "_project_#@osd#interpreter#url-loader" depends on it.
info Disk size without dependencies: "84KB"
info Disk size with unique dependencies: "348KB"
info Disk size with transitive dependencies: "452KB"
info Number of shared dependencies: 4
=> Found "webpack#[email protected]"
info This module exists because "_project_#@osd#ace#webpack" depends on it.
info Disk size without dependencies: "84KB"
info Disk size with unique dependencies: "348KB"
info Disk size with transitive dependencies: "452KB"
info Number of shared dependencies: 4

[email protected] /home/ubuntu/work/OpenSearch-Dashboards
├─┬ @osd/[email protected] -> /home/ubuntu/work/OpenSearch-Dashboards/packages/osd-eslint-import-resolver-opensearch-dashboards
│ └─┬ [email protected]
│   └── [email protected] 
├─┬ @osd/[email protected] -> /home/ubuntu/work/OpenSearch-Dashboards/packages/osd-optimizer
│ ├─┬ [email protected]
│ │ └── [email protected] 
│ ├─┬ [email protected]
│ │ └── [email protected]  deduped
│ ├─┬ [email protected]
│ │ └── [email protected] 
│ ├── [email protected] 
│ ├─┬ [email protected]
│ │ └── [email protected]  deduped
│ ├─┬ [email protected]
│ │ └── [email protected]  deduped
│ ├─┬ [email protected]
│ │ └── [email protected]  deduped
│ ├─┬ [email protected]
│ │ └── [email protected]  deduped
│ ├─┬ [email protected]
│ │ └── [email protected] 
│ └─┬ [email protected]
│   └── [email protected] 
└─┬ @osd/[email protected] -> /home/ubuntu/work/OpenSearch-Dashboards/packages/osd-ui-shared-deps
  ├── [email protected]  extraneous
  └─┬ [email protected]
    └── [email protected]  deduped

[ananzh]

There are a lot of packages using loader-utils. I will update a summary here later

[ananzh]

• This cve is about a Regular expression denial of service (ReDoS) flaw was found in Function interpolateName (code). I checked our repo, I don’t see any interpolateName func used in our code. Meanwhile, according to the usage and also search in loader-utils repo, I don’t see any indirect calling on this method.
• loader-utils v2 are not deprecated. upgrade it to v3 requires webpack been bumped to v5 (reference). This is a breaking change.
• Since we don’t use interpolateName directly or indirectly, I think we are not impacted. Need to double check and a bit more research.