PT-2018-4723 · Node · Uws

Publicado 2018-05-31 · Atualizado 2020-09-01 · CVE-2016-10544

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions uws versions 0.10.0 through 0.10.8

Description The issue arises when a WebSocket server instance with permessage-deflate enabled receives a large WebSocket message. If a 256MB WebSocket message is sent, the compression may shrink it to less than 16MB, allowing it to pass the length check. However, upon inflation, the data can exceed V8's maximum string size, causing the Node process to crash. This can result in a denial of service condition.

Recommendations Update to version 0.10.9 or later. As a temporary workaround, consider disabling the permessage-deflate feature to minimize the risk of exploitation.

Correção

Resource Exhaustion

RCE

Enumeração de Fraquezas

CWE-400

CWE-20

Identificadores relacionados

CVE-2016-10544

GHSA-HF5H-HH56-3VRG

Produtos afetados

Uws

Referências · 6

• https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-10544 · Nota de Segurança
• https://nodesecurity.io/advisories/149 · Nota
• https://osv.dev/vulnerability/CVE-2016-10544 · Aviso do Fabricante
• https://npmjs.com/advisories/149 · Nota
• https://osv.dev/vulnerability/GHSA-hf5h-hh56-3vrg · Aviso do Fabricante