PT-2018-4700 · Jadedown · Jadedown

Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10520

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jadedown (affected versions not specified)

Description The issue concerns a regular expression denial of service (ReDoS) vulnerability. It occurs when certain types of user input are passed in, causing the software to become unresponsive. The estimated time to block the service can be as low as 5 seconds with a relatively small input size of 48 characters. This vulnerability was identified on October 24, 2015, and maintainers were notified the same day. They responded with intent to fix on October 25, 2015. An advisory was published on January 5, 2016.

Recommendations As a temporary workaround, consider refactoring the dependent application to not make use of the jadedown module, especially if it is used to process user input, since the package is not actively maintained and has not seen an update since 2011. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2016-10520

GHSA-6354-6MHV-MVV5

Affected Products

Jadedown

References · 6

• 🔥 https://nodesecurity.io/advisories/52 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10520 · Security Note
• https://osv.dev/vulnerability/GHSA-6354-6mhv-mvv5 · Vendor Advisory
• https://github.com/advisories/GHSA-6354-6mhv-mvv5 · Note
• https://npmjs.com/advisories/52 · Note