PT-2019-20081 · Marked · Marked

Publicado 2019-06-05 · Atualizado 2019-06-05

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions marked versions 0.3.14 through 0.6.1

Description The issue allows attackers to potentially crash the node process due to resource exhaustion by evaluating email addresses in quadratic time.

Recommendations For marked versions 0.3.14 through 0.6.1, upgrade to version 0.6.2 or later.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

GHSA-XF5P-87CH-GXW2

Produtos afetados

Marked

Referências · 7

• https://github.com/markedjs/marked · Nota
• https://github.com/markedjs/marked/releases/tag/v0.6.2 · Nota
• https://github.com/markedjs/marked/commit/b15e42b67cec9ded8505e9d68bb8741ad7a9590d · Nota
• https://github.com/markedjs/marked/pull/1460 · Nota
• https://osv.dev/vulnerability/GHSA-xf5p-87ch-gxw2 · Aviso do Fabricante
• https://npmjs.com/advisories/812 · Nota
• https://snyk.io/vuln/SNYK-JS-MARKED-174116 · Nota