PT-2021-16842 · Dotty · Dotty

Stramel · Published 2021-02-02 · Updated 2023-08-08 · CVE-2021-25912

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dotty versions 0.0.1 through 0.1.0

Description The issue is a prototype pollution vulnerability that allows attackers to cause a denial of service and may lead to remote code execution.

Recommendations For dotty versions 0.0.1 through 0.1.0, update to version 0.1.1 or later to resolve the issue.

Exploit

Fix

Prototype Pollution

Resource Exhaustion

Weakness Enumeration

CWE-1321

CWE-400

Related Identifiers

CVE-2021-25912

GHSA-F5C9-X9J6-87QP

Affected Products

Dotty

References · 9

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25912 · Exploit
• https://github.com/deoxxa/dotty/commit/cd997d37917186c131be71501a698803f2b7ebdb · Patch
• https://osv.dev/vulnerability/GHSA-f5c9-x9j6-87qp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25912 · Security Note
• https://npmjs.com/package/dotty · Note
• https://t.me/cibsecurity/31755 · Telegram Post
• https://t.me/cvenotify/23056 · Telegram Post
• https://t.me/cibsecurity/22970 · Telegram Post