PT-2021-18248 · Npm · Cumulative-Distribution-Function

Drpaulbrewer · Published 2021-04-30 · Updated 2022-08-03 · CVE-2021-29486

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: cumulative-distribution-function versions prior to 2.0.0

Description: The issue arises when the cumulative-distribution-function library is used with improper data, potentially causing apps to crash or enter an infinite loop. This can occur in both nodejs server-apps and browser apps when they process invalid non-numeric data. The vulnerability enables an infinite-cpu-loop denial-of-service-attack if an attacker can supply malformed data to the library. It may also manifest if a data source changes from numeric to string data without detection by earlier versions of the library.

Recommendations: For versions prior to 2.0.0, upgrade to at least v2.0.0 or the latest version to resolve the issue. As a temporary workaround for older versions, ensure that only finite numeric data of type Array[number] or number is passed to cumulative-distribution-function and its f(x) function, respectively. Developers using this library may wish to adjust their app's code to better tolerate or handle the TypeError() thrown by version 2.0.0 when it encounters invalid data.

Exploit

Fix

Infinite Loop

RCE

Weakness Enumeration

CWE-835

CWE-20

Related Identifiers

CVE-2021-29486

GHSA-58QP-5328-V7MH

Affected Products

Cumulative-Distribution-Function

References · 7

• 🔥 https://github.com/DrPaulBrewer/cumulative-distribution-function/issues/7 · Exploit
• https://github.com/DrPaulBrewer/cumulative-distribution-function/pull/8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29486 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29486 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-58qp-5328-v7mh · Vendor Advisory
• https://github.com/DrPaulBrewer/cumulative-distribution-function/security/advisories/GHSA-58qp-5328-v7mh · Note
• https://npmjs.com/package/cumulative-distribution-function · Note