PT-2019-15217 · Csv Parse · Csv-Parse

Published 2019-10-14 · Updated 2022-01-01 · CVE-2019-17592

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions csv-parse versions prior to 4.4.6

Description The issue concerns a Regular Expression Denial of Service in the isInt() function, which contains a malformed regular expression. This function processes large crafted input very slowly when the cast option is used, leading to a Denial of Service.

Recommendations Upgrade to version 4.4.6 or later. As a temporary workaround, consider avoiding the use of the cast option until the issue is resolved.

Fix

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

CVE-2019-17592

GHSA-582F-P4PG-XC74

Affected Products

Csv-Parse

References · 9

• https://github.com/adaltas/node-csv-parse/commit/b9d35940c6815cdf1dfd6b21857a1f6d0fd51e4a · Patch
• https://osv.dev/vulnerability/CVE-2019-17592 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-582f-p4pg-xc74 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17592 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP · Vendor Advisory
• https://github.com/adaltas/node-csv-parse · Note
• https://security.netapp.com/advisory/ntap-20191127-0002 · Note
• https://npmjs.com/advisories/1171 · Note