PT-2019-20007 · Ws · Ws

Publicado 2019-06-04 · Atualizado 2019-06-04

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ws versions prior to 3.3.1

Description The issue arises when a specially crafted Sec-WebSocket-Extensions header is sent, containing Object.prototype property names as extension or parameter names, which can cause affected versions of ws to crash.

Recommendations Update to version 3.3.1 or later.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

GHSA-5V72-XG48-5RPM

Produtos afetados

Ws

Referências · 6

• https://github.com/websockets/ws/commit/f8fdcd40ac8be7318a6ee41f5ceb7e77c995b407 · Nota
• https://github.com/websockets/ws/commit/c4fe46608acd61fbf7397eadc47378903f95b78a · Nota
• https://npmjs.com/advisories/550/versions · Nota
• https://snyk.io/vuln/npm:ws:20171108 · Nota
• https://osv.dev/vulnerability/GHSA-5v72-xg48-5rpm · Aviso do Fabricante
• https://npmjs.com/advisories/550 · Nota