PT-2018-4552 · Ansi2Html · Ansi2Html

Published 2018-05-31 · Updated 2020-09-01 · CVE-2015-9239

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ansi2html versions prior to a fixed version (no specific fixed version mentioned)

Description The issue is related to a regular expression denial of service (ReDoS) vulnerability. When certain types of user input are passed in, it can cause a denial of service. The estimated time to parse the input string grows significantly with the size of the input, making it unlikely to allow strings of a useful size while protecting against the denial of service attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider avoiding passing user input to the ansi2html package, or limit the size of the input string to a size with a parse time you find acceptable. In the case that user input of significant length must be parsed by ansi2html, the best mitigation is to use an alternative module that provides similar functionality.

Exploit

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

CVE-2015-9239

GHSA-C2V2-7RCG-2CH7

Affected Products

Ansi2Html

References · 4

• 🔥 https://nodesecurity.io/advisories/51 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9239 · Security Note
• https://osv.dev/vulnerability/GHSA-c2v2-7rcg-2ch7 · Vendor Advisory
• https://npmjs.com/advisories/51 · Note