PT-2018-3975 · Npm · Sshpk

Chalker · CVE-2018-3737 · Publicado 2018-02-25 · Atualizado 2023-01-30

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions sshpk versions prior to 1.13.2 sshpk versions prior to 1.14.1

Description The issue is related to the parsing of crafted invalid public keys, which can lead to a regular expression denial of service. This can cause a denial of service, allowing a remote attacker to disrupt service. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 1.13.2, update to version 1.13.2 or later. For versions prior to 1.14.1, update to version 1.14.1 or later.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

CWE-185

Identificadores relacionados

BDU:2024-01219

CVE-2018-3737

GHSA-2M39-62FM-Q8R3

RHSA-2020:2625

Produtos afetados

Sshpk

Referências · 18

• 🔥 https://hackerone.com/reports/319593 · Exploit
• https://github.com/TritonDataCenter/node-sshpk/issues/44 · Nota
• https://github.com/TritonDataCenter/node-sshpk/commit/46065d38a5e6d1bccf86d3efb2fb83c14e3f9957 · Nota
• https://github.com/joyent/node-sshpk/blob/v1.13.1/lib/formats/ssh.js#L17 · Nota
• https://github.com/joyent/node-sshpk/issues/44 · Nota
• https://github.com/joyent/node-sshpk/commit/46065d38a5e6d1bccf86d3efb2fb83c14e3f9957 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3737 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-3737 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-3737 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2020:2625 · Nota
• https://npmjs.com/advisories/606 · Nota
• https://osv.dev/vulnerability/GHSA-2m39-62fm-q8r3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-3737 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-01219 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3737 · Aviso do Fabricante