PT-2019-15217 · Csv Parse · Csv-Parse

Publicado 2019-10-14 · Atualizado 2022-01-01 · CVE-2019-17592

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions csv-parse versions prior to 4.4.6

Description The issue concerns a Regular Expression Denial of Service in the isInt() function, which contains a malformed regular expression. This function processes large crafted input very slowly when the cast option is used, leading to a Denial of Service.

Recommendations Upgrade to version 4.4.6 or later. As a temporary workaround, consider avoiding the use of the cast option until the issue is resolved.

Correção

RCE

Resource Exhaustion

Enumeração de Fraquezas

CWE-20

CWE-400

Identificadores relacionados

CVE-2019-17592

GHSA-582F-P4PG-XC74

Produtos afetados

Csv-Parse

Referências · 9

• https://github.com/adaltas/node-csv-parse · Nota
• https://github.com/adaltas/node-csv-parse/commit/b9d35940c6815cdf1dfd6b21857a1f6d0fd51e4a · Correção
• https://osv.dev/vulnerability/CVE-2019-17592 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20191127-0002 · Nota
• https://osv.dev/vulnerability/GHSA-582f-p4pg-xc74 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17592 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP · Aviso do Fabricante
• https://npmjs.com/advisories/1171 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP · Aviso do Fabricante