PT-2018-3672 · Debug · Debug

Publicado 2018-06-07 · Atualizado 2021-05-25 · CVE-2017-16137

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions debug versions prior to 2.6.9 debug versions 3.2.0 through 3.2.6 debug versions 4.0.0 through 4.3.0

Description The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. This issue is considered low severity as it takes around 50,000 characters to block the event loop for 2 seconds. The vulnerability can be exploited by a remote attacker using a specially crafted regular expression, potentially leading to a denial of service.

Recommendations Version 2.x.x: Update to version 2.6.9 or later. Version 3.1.x: Update to version 3.1.0 or later. Version 3.2.x: Update to version 3.2.7 or later. Version 4.x.x: Update to version 4.3.1 or later.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

AZL-43792

AZL-43819

AZL-44400

AZL-44772

BDU:2021-02886

CVE-2017-16137

GHSA-GXPJ-CX7G-858C

Produtos afetados

Debug

Referências · 27

• https://github.com/visionmedia/debug/pull/504 · Correção
• https://github.com/visionmedia/debug/issues/501 · Nota
• https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020 · Nota
• https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290 · Nota
• https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a · Nota
• https://github.com/debug-js/debug/issues/797 · Nota
• https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac · Nota
• https://github.com/visionmedia/debug · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-16137 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16137 · Nota de Segurança
• https://bdu.fstec.ru/vul/2021-02886 · Nota de Segurança
• https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2017-16137 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E · Nota
• https://osv.dev/vulnerability/AZL-44772 · Aviso do Fabricante