PT-2014-5477 · Hapi · Hapi

Published 2014-05-16 · Updated 2017-10-24 · CVE-2014-3742

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions hapi server framework versions 2.0.x through 2.1.x

Description The issue allows remote attackers to cause a denial of service via unspecified vectors, resulting in file descriptor consumption and process crash. This is due to a file descriptor leak that, when triggered repeatedly, will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit.

Recommendations For versions 2.0.x and 2.1.x, please upgrade to version 2.2.x or above as soon as possible.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-399

CWE-400

Related Identifiers

CVE-2014-3742

GHSA-CQR7-78PJ-3G7J

Affected Products

Hapi

References · 9

• https://osv.dev/vulnerability/GHSA-cqr7-78pj-3g7j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3742 · Security Note
• https://nodesecurity.io/advisories/hapi_File_descriptor_leak_DoS_vulnerability · Vendor Advisory
• https://github.com/spumko/hapi/issues/1427 · Note
• https://github.com/spumko/hapi · Note
• http://openwall.com/lists/oss-security/2014/05/15/2 · Note
• http://openwall.com/lists/oss-security/2014/05/13/1 · Note
• https://github.com/advisories/GHSA-cqr7-78pj-3g7j · Note
• https://npmjs.com/advisories/11 · Note