PT-2018-6060 · Useragent · Useragent

Publicado 2018-06-04 · Atualizado 2019-10-09 · CVE-2017-16030

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Useragent versions 2.1.12 and earlier

Description: The issue arises from the use of regular expressions in the Useragent library to parse useragent headers. An attacker can exploit this by editing their own headers to create an arbitrarily long useragent string, potentially causing the event loop and server to block.

Recommendations: For versions 2.1.12 and earlier, update to version 2.1.13 or later.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2017-16030

GHSA-PJMX-9XR3-82QR

Produtos afetados

Useragent

Referências · 6

• 🔥 https://nodesecurity.io/advisories/312 · Exploit
• https://npmjs.com/advisories/312 · Nota
• https://osv.dev/vulnerability/CVE-2017-16030 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16030 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-pjmx-9xr3-82qr · Aviso do Fabricante
• https://github.com/advisories/GHSA-pjmx-9xr3-82qr · Nota