PT-2018-6157 · Npm · Superagent

Publicado 2018-06-07 · Atualizado 2019-10-09 · CVE-2017-16129

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: superagent versions prior to 3.7.0

Description: The HTTP client module superagent is vulnerable to ZIP bomb attacks. In such an attack, an HTTP server replies with a compressed response that becomes significantly larger once uncompressed. If the client does not handle these responses carefully, it may lead to excessive CPU and/or memory consumption, potentially allowing an attacker to exploit this weakness for a denial of service (DoS) attack. The attacker must control the URL that superagent makes a request to in order to exploit this issue.

Recommendations: Update to version 3.7.0 or later.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-409

CWE-400

Identificadores relacionados

CVE-2017-16129

GHSA-8225-6CVR-8PQP

Produtos afetados

Superagent

Referências · 13

• https://github.com/visionmedia/superagent/issues/1259 · Correção
• https://nodesecurity.io/advisories/479 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16129 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8225-6cvr-8pqp · Aviso do Fabricante
• https://en.wikipedia.org/wiki/Zip_bomb · Nota
• https://npmjs.com/advisories/479 · Nota
• https://osv.dev/vulnerability/CVE-2017-16129 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16129 · Nota de Segurança
• https://github.com/advisories/GHSA-8225-6cvr-8pqp · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-16129 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16129 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-16129 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-16129 · Aviso do Fabricante