PT-2018-3672 · Debug · Debug

Published 2018-06-07 · Updated 2021-05-25 · CVE-2017-16137

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions debug versions prior to 2.6.9 debug versions 3.2.0 through 3.2.6 debug versions 4.0.0 through 4.3.0

Description The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. This issue is considered low severity as it takes around 50,000 characters to block the event loop for 2 seconds. The vulnerability can be exploited by a remote attacker using a specially crafted regular expression, potentially leading to a denial of service.

Recommendations Version 2.x.x: Update to version 2.6.9 or later. Version 3.1.x: Update to version 3.1.0 or later. Version 3.2.x: Update to version 3.2.7 or later. Version 4.x.x: Update to version 4.3.1 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

AZL-43792

AZL-43819

AZL-44400

AZL-44772

BDU:2021-02886

CVE-2017-16137

GHSA-GXPJ-CX7G-858C

Affected Products

Debug

References · 27

• https://github.com/visionmedia/debug/pull/504 · Patch
• https://security-tracker.debian.org/tracker/CVE-2017-16137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16137 · Security Note
• https://bdu.fstec.ru/vul/2021-02886 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16137 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44772 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16137 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gxpj-cx7g-858c · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16137 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43819 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16137 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44400 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16137 · Security Note
• https://osv.dev/vulnerability/AZL-43792 · Vendor Advisory
• https://github.com/visionmedia/debug/issues/501 · Note