PT-2023-10614 · Vercel · Vercel Ms

CVE-2017-20162 · Publicado 2023-01-05 · Atualizado 2024-05-17

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions vercel ms versions up to 1.x

Description A problematic issue has been found in the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For vercel ms versions up to 1.x, upgrade to version 2.0.0 to address this issue. As a temporary workaround, consider restricting the use of the parse function in the index.js file until the patch is applied. Restrict access to the str argument to minimize the risk of exploitation.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

AZL-43849

AZL-44002

AZL-45126

AZL-45201

CVE-2017-20162

GHSA-W9MR-4MFR-499F

Produtos afetados

Vercel Ms

Referências · 18

• 🔥 https://github.com/vercel/ms/pull/89 · Exploit
• https://github.com/vercel/ms/commit/caae2988ba2a37765d055c4eee63d383320ee662 · Correção
• https://github.com/vercel/ms/releases/tag/2.0.0 · Correção
• https://github.com/vercel/ms · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-20162 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-20162 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-43849 · Aviso do Fabricante
• https://t.me/cvenotify/41295 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-w9mr-4mfr-499f · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-45126 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-20162 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-45201 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-44002 · Aviso do Fabricante
• https://vuldb.com/?id.217451 · Nota
• https://security.netapp.com/advisory/ntap-20241108-0002 · Nota