PT-2017-7489 · Npm+2 · Semver+2

Published 2016-04-13 · Updated 2021-03-15 · CVE-2015-8855

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions semver versions prior to 4.3.2

Description The issue allows attackers to cause a denial of service, specifically CPU consumption, via a long version string. This is referred to as a regular expression denial of service (ReDoS). The vulnerability is triggered when extremely long version strings are parsed.

Recommendations Update to version 4.3.2 or later. As a temporary workaround, consider restricting the input of version strings to prevent extremely long strings from being parsed.

Fix

DoS

Weakness Enumeration

CWE-1333

CWE-399

Related Identifiers

ALT-PU-2016-1328

CVE-2015-8855

GHSA-X6FG-F45M-JF5Q

USN-4776-1

Affected Products

Alt Linux

Ubuntu

Semver

References · 22

• https://osv.dev/vulnerability/GHSA-x6fg-f45m-jf5q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8855 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8855 · Vendor Advisory
• https://nodesecurity.io/advisories/31 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8855 · Security Note
• https://osv.dev/vulnerability/USN-4776-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8855 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4776-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8855 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8855 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8855 · Security Note
• https://github.com/npm/npm/releases/tag/v2.7.5 · Note
• https://github.com/npm/node-semver · Note
• https://github.com/npm/node-semver/commit/5c4c9f6e26c7052a42b5ced2a7481c5c9b4363a0 · Note
• https://github.com/npm/node-semver/commit/c80180d8341a8ada0236815c29a2be59864afd70 · Note