CVE-2024-41818
Fixed in a distro release EPSS <1%CVSS 7.5
fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.
Products: NaturalIntelligence fast-xml-parser
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | fast-xml-parser | 4.4.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kubeflow-pipelines | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-apiserver | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-cache_server | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-frontend | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.2.0-r9 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r9 |
| Chainguard | renovate | 38.18.0-r0 |
| Wolfi | kubeflow-pipelines | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-apiserver | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-cache_server | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-frontend | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.2.0-r9 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r9 |
| Wolfi | renovate | 38.18.0-r0 |