CVE-2024-21538 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2024-21538	HIGH	cross-spawn	7.0.3	7.0.5	2024-11-08T05:15:06.453Z	2024-11-16T10:18:36.690396835Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:007cd808b9e613993c616a321ae4c30416b269df12b841e6b92fe67918402aa1
public.ecr.aws/lambda/nodejs:20	public.ecr.aws/lambda/nodejs@sha256:007cd808b9e613993c616a321ae4c30416b269df12b841e6b92fe67918402aa1
public.ecr.aws/lambda/nodejs:18	public.ecr.aws/lambda/nodejs@sha256:cbe1e63bffb0008f12ea21b4790386e177f609163b7a59136b5ee8d8bbf465f2

---

Description

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

---

Remediation Steps

• Update the affected package cross-spawn from version 7.0.3 to 7.0.5.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.