PT-2019-20004 · Mem · Mem

Publicado 2019-07-05 · Atualizado 2019-07-05

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Média

Vetor base

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mem versions prior to 4.0.0

Description The issue allows attackers to potentially exhaust the system's memory by abusing the application logging, as the package fails to remove old values from the cache even after a value passes its maxAge property.

Recommendations Upgrade to version 4.0.0 or later.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

GHSA-4XCV-9JJX-GFJ3

Produtos afetados

Mem

Referências · 5

• https://github.com/sindresorhus/mem/commit/da4e4398cb27b602de3bd55f746efa9b4a31702b · Nota
• https://osv.dev/vulnerability/GHSA-4xcv-9jjx-gfj3 · Aviso do Fabricante
• https://snyk.io/vuln/npm:mem:20180117 · Nota
• https://npmjs.com/advisories/1084 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1623744 · Nota