PT-2019-20007 · Ws · Ws

Published 2019-06-04 · Updated 2019-06-04

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ws versions prior to 3.3.1

Description The issue arises when a specially crafted Sec-WebSocket-Extensions header is sent, containing Object.prototype property names as extension or parameter names, which can cause affected versions of ws to crash.

Recommendations Update to version 3.3.1 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-5V72-XG48-5RPM

Affected Products

Ws

References · 6

• https://osv.dev/vulnerability/GHSA-5v72-xg48-5rpm · Vendor Advisory
• https://github.com/websockets/ws/commit/f8fdcd40ac8be7318a6ee41f5ceb7e77c995b407 · Note
• https://github.com/websockets/ws/commit/c4fe46608acd61fbf7397eadc47378903f95b78a · Note
• https://npmjs.com/advisories/550/versions · Note
• https://snyk.io/vuln/npm:ws:20171108 · Note
• https://npmjs.com/advisories/550 · Note