PT-2014-7826 · Npm · Qs

Published 2014-10-19 · Updated 2018-10-09 · CVE-2014-7191

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions qs versions prior to 1.0.0

Description The issue allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array, as the qs module does not call the compact function for array data. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.

Recommendations Update to version 1.0.0 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-399

CWE-400

Related Identifiers

CVE-2014-7191

GHSA-CRVJ-3GJ9-GM2P

GHSA-JJV7-QPX3-H62Q

RHSA-2016:1380

Affected Products

Qs

References · 23

• https://ubuntu.com/security/CVE-2014-7191 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:1380 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jjv7-qpx3-h62q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7191 · Security Note
• https://osv.dev/vulnerability/CVE-2014-7191 · Vendor Advisory
• ❌ https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8 · Patch, Deleted
• https://security-tracker.debian.org/tracker/CVE-2014-7191 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7191 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crvj-3gj9-gm2p · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7191 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-7191 · Security Note
• https://github.com/visionmedia/node-querystring/issues/104 · Note
• https://github.com/visionmedia/node-querystring · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96729 · Note
• https://nodesecurity.io/advisories/qs_dos_memory_exhaustion · Note