PT-2019-20004 · Mem · Mem

Published 2019-07-05 · Updated 2019-07-05

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mem versions prior to 4.0.0

Description The issue allows attackers to potentially exhaust the system's memory by abusing the application logging, as the package fails to remove old values from the cache even after a value passes its maxAge property.

Recommendations Upgrade to version 4.0.0 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-4XCV-9JJX-GFJ3

Affected Products

Mem

References · 5

• https://osv.dev/vulnerability/GHSA-4xcv-9jjx-gfj3 · Vendor Advisory
• https://github.com/sindresorhus/mem/commit/da4e4398cb27b602de3bd55f746efa9b4a31702b · Note
• https://snyk.io/vuln/npm:mem:20180117 · Note
• https://npmjs.com/advisories/1084 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1623744 · Note