PT-2018-4555 · Node.Js · Ecstatic

Ghost · Published 2018-05-29 · Updated 2019-10-09 · CVE-2015-9242

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ecstatic versions prior to 1.4.0

Description The issue arises when certain input strings are passed to new Date() or Date.parse() in the ecstatic node module, causing v8 to raise an exception and leading to a crash and denial of service. This occurs when the input is passed into the server via the "If-Modified-Since" header or the "Last-Modified" header. The exception is triggered by parsing certain inputs with new Date() or Date.parse(), resulting in a server crash.

Recommendations Update to version 1.4.0 or later.

Fix

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

CVE-2015-9242

GHSA-VWJC-Q9PX-R9VQ

Affected Products

Ecstatic

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2015-9242 · Security Note
• https://osv.dev/vulnerability/GHSA-vwjc-q9px-r9vq · Vendor Advisory
• https://github.com/jfhbrook/node-ecstatic · Note
• https://github.com/jfhbrook/node-ecstatic/commit/0d0a2779ac5e5843d3745920212dfac9b69440e2 · Note
• https://github.com/jfhbrook/node-ecstatic/pull/179 · Note
• https://bugs.chromium.org/p/v8/issues/detail?id=4640 · Note
• https://nodesecurity.io/advisories/64 · Note