PT-2017-7489 · Npm+2 · Semver+2

Publicado 2016-04-13 · Atualizado 2021-03-15 · CVE-2015-8855

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions semver versions prior to 4.3.2

Description The issue allows attackers to cause a denial of service, specifically CPU consumption, via a long version string. This is referred to as a regular expression denial of service (ReDoS). The vulnerability is triggered when extremely long version strings are parsed.

Recommendations Update to version 4.3.2 or later. As a temporary workaround, consider restricting the input of version strings to prevent extremely long strings from being parsed.

Correção

DoS

Enumeração de Fraquezas

CWE-1333

CWE-399

Identificadores relacionados

ALT-PU-2016-1328

CVE-2015-8855

GHSA-X6FG-F45M-JF5Q

USN-4776-1

Produtos afetados

Alt Linux

Ubuntu

Semver

Referências · 22

• https://github.com/npm/npm/releases/tag/v2.7.5 · Nota
• https://github.com/npm/node-semver · Nota
• https://github.com/npm/node-semver/commit/5c4c9f6e26c7052a42b5ced2a7481c5c9b4363a0 · Nota
• https://github.com/npm/node-semver/commit/c80180d8341a8ada0236815c29a2be59864afd70 · Nota
• https://github.com/github/advisory-database/pull/7102 · Nota
• https://osv.dev/vulnerability/GHSA-x6fg-f45m-jf5q · Aviso do Fabricante
• https://nodesecurity.io/advisories/semver_redos · Nota
• https://npmjs.com/advisories/31 · Nota
• https://github.com/advisories/GHSA-x6fg-f45m-jf5q · Nota
• https://osv.dev/vulnerability/CVE-2015-8855 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8855 · Aviso do Fabricante
• https://nodesecurity.io/advisories/31 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-8855 · Nota de Segurança
• https://osv.dev/vulnerability/USN-4776-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/04/20/11 · Nota