PT-2018-4700 · Jadedown · Jadedown

Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10520

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jadedown (affected versions not specified)

Description The issue concerns a regular expression denial of service (ReDoS) vulnerability. It occurs when certain types of user input are passed in, causing the software to become unresponsive. The estimated time to block the service can be as low as 5 seconds with a relatively small input size of 48 characters. This vulnerability was identified on October 24, 2015, and maintainers were notified the same day. They responded with intent to fix on October 25, 2015. An advisory was published on January 5, 2016.

Recommendations As a temporary workaround, consider refactoring the dependent application to not make use of the jadedown module, especially if it is used to process user input, since the package is not actively maintained and has not seen an update since 2011. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

RCE

Enumeração de Fraquezas

CWE-400

CWE-20

Identificadores relacionados

CVE-2016-10520

GHSA-6354-6MHV-MVV5

Produtos afetados

Jadedown

Referências · 6

• 🔥 https://nodesecurity.io/advisories/52 · Exploit
• https://github.com/advisories/GHSA-6354-6mhv-mvv5 · Nota
• https://osv.dev/vulnerability/CVE-2016-10520 · Aviso do Fabricante
• https://npmjs.com/advisories/52 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10520 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6354-6mhv-mvv5 · Aviso do Fabricante