PT-2018-4555 · Node.Js · Ecstatic

Ghost · Publicado 2018-05-29 · Atualizado 2019-10-09 · CVE-2015-9242

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ecstatic versions prior to 1.4.0

Description The issue arises when certain input strings are passed to new Date() or Date.parse() in the ecstatic node module, causing v8 to raise an exception and leading to a crash and denial of service. This occurs when the input is passed into the server via the "If-Modified-Since" header or the "Last-Modified" header. The exception is triggered by parsing certain inputs with new Date() or Date.parse(), resulting in a server crash.

Recommendations Update to version 1.4.0 or later.

Correção

RCE

Resource Exhaustion

Enumeração de Fraquezas

CWE-20

CWE-400

Identificadores relacionados

CVE-2015-9242

GHSA-VWJC-Q9PX-R9VQ

Produtos afetados

Ecstatic

Referências · 7

• https://github.com/jfhbrook/node-ecstatic · Nota
• https://github.com/jfhbrook/node-ecstatic/commit/0d0a2779ac5e5843d3745920212dfac9b69440e2 · Nota
• https://github.com/jfhbrook/node-ecstatic/pull/179 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-9242 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vwjc-q9px-r9vq · Aviso do Fabricante
• https://bugs.chromium.org/p/v8/issues/detail?id=4640 · Nota
• https://nodesecurity.io/advisories/64 · Nota