PT-2019-5778 · Nginx · Njs

Shuoz · Publicado 2019-06-03 · Atualizado 2022-03-24 · CVE-2019-13617

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions njs versions through 0.3.3

Description The issue is related to a heap-based buffer over-read in the nxt vsprintf function in nxt/nxt sprintf.c during error handling. This can occur when an njs regexp literal call leads to an njs parser lexer error call and then an njs parser scope error call. The vulnerability may allow a remote attacker to cause a denial of service.

Recommendations For njs versions through 0.3.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

BDU:2021-02124

CVE-2019-13617

Produtos afetados

Njs

Referências · 8

• 🔥 https://github.com/nginx/njs/issues/174 · Exploit
• https://github.com/nginx/njs/commit/ee400ea880dc46bb02c4be2564b183c114d4cd42 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-13617 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13617 · Aviso do Fabricante
• https://cxsecurity.com/cveshow/CVE-2019-13617 · Nota
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15093 · Nota
• https://bdu.fstec.ru/vul/2021-02124 · Nota de Segurança
• https://ibm.com/support/pages/node/3655191 · Nota