PT-2018-16185 · Memjs · Memjs

Chalker · Publicado 2018-07-05 · Atualizado 2019-10-09 · CVE-2018-3767

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions memjs versions <= 1.1.0 memjs versions prior to 1.2.2

Description The issue results in Denial of Service (DoS) and uninitialized memory usage due to the allocation and storage of buffers on typed input. The package fails to sanitize the value option passed to the Buffer constructor, allowing attackers to pass large values that exhaust system resources.

Recommendations For memjs versions <= 1.1.0, upgrade to version 1.2.2 or later. For memjs versions prior to 1.2.2, upgrade to version 1.2.2 or later.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2018-3767

GHSA-CX8M-8XMX-Q8V3

Produtos afetados

Memjs

Referências · 6

• 🔥 https://hackerone.com/reports/319809 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3767 · Nota de Segurança
• https://github.com/advisories/GHSA-cx8m-8xmx-q8v3 · Nota
• https://npmjs.com/advisories/970 · Nota
• https://osv.dev/vulnerability/GHSA-cx8m-8xmx-q8v3 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-3767 · Aviso do Fabricante