PT-2020-6063 · Github+1 · Node-Fetch+1

Rynop + 1 · Published 2020-09-10 · Updated 2021-05-25 · CVE-2020-15168

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions node-fetch versions prior to 2.6.1 node-fetch versions prior to 3.0.0-beta.9

Description The issue is related to the node-fetch library not honoring the size option after following a redirect. This means that when a content size is over the limit, a FetchError would never get thrown and the process would end without failure. For most users, this fix will have little or no impact. However, if you rely on node-fetch to gate files above a size, the impact could be significant. For example, if you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file, potentially leading to a denial of service (DoS) or increased computing costs.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later. For versions prior to 3.0.0-beta.9, update to version 3.0.0-beta.9 or later. As a temporary workaround, consider double-checking the size of the data after fetch() has completed to prevent potential denial of service (DoS) or increased computing costs.

Fix

DoS

Resource Exhaustion

RCE

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-20

CWE-770

Related Identifiers

BDU:2021-02871

CVE-2020-15168

GHSA-W7RC-RWVF-8Q5R

SUSE-SU-2020:3235-1

Affected Products

Suse

Node-Fetch

References · 48

• https://nvd.nist.gov/vuln/detail/CVE-2020-15168 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15168 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15168 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15168 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15168 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02871 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-15168 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15168 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:3235-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7rc-rwvf-8q5r · Vendor Advisory
• https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r · Note
• https://github.com/node-fetch/node-fetch/commit/eaff0094c4dfdd5b78711a8c4f1b61e33d282072 · Note
• https://github.com/node-fetch/node-fetch/commit/2358a6c2563d1730a0cdaccc197c611949f6a334 · Note
• https://github.com/node-fetch/node-fetch · Note
• https://bugzilla.suse.com/1177524 · Note