PT-2018-6157 · Npm · Superagent

Published 2018-06-07 · Updated 2019-10-09 · CVE-2017-16129

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: superagent versions prior to 3.7.0

Description: The HTTP client module superagent is vulnerable to ZIP bomb attacks. In such an attack, an HTTP server replies with a compressed response that becomes significantly larger once uncompressed. If the client does not handle these responses carefully, it may lead to excessive CPU and/or memory consumption, potentially allowing an attacker to exploit this weakness for a denial of service (DoS) attack. The attacker must control the URL that superagent makes a request to in order to exploit this issue.

Recommendations: Update to version 3.7.0 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-409

CWE-400

Related Identifiers

CVE-2017-16129

GHSA-8225-6CVR-8PQP

Affected Products

Superagent

References · 13

• https://github.com/visionmedia/superagent/issues/1259 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16129 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8225-6cvr-8pqp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16129 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-16129 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16129 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16129 · Security Note
• https://ubuntu.com/security/CVE-2017-16129 · Vendor Advisory
• https://nodesecurity.io/advisories/479 · Note
• https://en.wikipedia.org/wiki/Zip_bomb · Note
• https://npmjs.com/advisories/479 · Note
• https://github.com/advisories/GHSA-8225-6cvr-8pqp · Note