PT-2023-12132 · Suchmokuo · Node-Worker-Threads-Pool

Exx8O · Publicado 2023-08-11 · Atualizado 2023-08-21 · CVE-2021-29057

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SUCHMOKUO node-worker-threads-pool version 1.4.3

Description An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool, allowing attackers to cause a denial of service. This issue can be mitigated by manually creating a timeout.

Recommendations For version 1.4.3, consider creating a timeout when using the StaticPool to mitigate the risk of denial of service, for example by using the setTimeout method on the executor, as shown in the provided example code.

Exploit

Correção

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

CVE-2021-29057

GHSA-7VXC-Q7RV-QFJ8

Produtos afetados

Node-Worker-Threads-Pool

Referências · 7

• 🔥 https://github.com/SUCHMOKUO/node-worker-threads-pool/issues/20 · Exploit
• https://github.com/SUCHMOKUO/node-worker-threads-pool · Nota
• https://twitter.com/CVEnew/status/1690264426832707584 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2021-29057 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2021-29057 · Aviso do Fabricante
• https://t.me/cibsecurity/68368 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-7vxc-q7rv-qfj8 · Aviso do Fabricante