Description
A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Unitech | pm2 | 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | pm2 | < 7.0.0 | 7.0.0 | GHSA-x5gf-qvw8-r2rm |
References
- VDB-311662 | Unitech pm2 Config.js redos vdb-entry
- VDB-311662 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #585750 | pm2 6.0.6 Inefficient Regular Expression Complexity third-party-advisory
- https://github.com/Unitech/pm2/pull/5971 issue-tracking
- https://gist.github.com/mmmsssttt404/407e2ffe3e0eaa393ad923a86316a385 exploit