PT-2021-22414 · Npm · Detect-Character-Encoding

Sonicdoe · Published 2021-08-24 · Updated 2021-09-01 · CVE-2021-39157

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions detect-character-encoding versions 0.6.0 and earlier

Description The issue occurs when data matching no charset causes the Node.js process to crash. This problem has been patched in version 0.7.0.

Recommendations For detect-character-encoding versions 0.6.0 and earlier, update to version 0.7.0 to resolve the issue.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2021-39157

GHSA-JQFH-8HW5-FQJR

Affected Products

Detect-Character-Encoding

References · 9

• 🔥 https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-jqfh-8hw5-fqjr · Exploit
• 🔥 https://github.com/sonicdoe/detect-character-encoding/issues/15 · Exploit
• https://github.com/sonicdoe/detect-character-encoding/commit/992a11007fff6cfd40b952150ab8d30410c4a20a · Patch
• https://osv.dev/vulnerability/GHSA-jqfh-8hw5-fqjr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39157 · Security Note
• https://github.com/sonicdoe/detect-character-encoding · Note
• https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.7.0 · Note
• https://t.me/cvenotify/20487 · Telegram Post