PT-2021-23141 · Unknown · Modern-Async

Nicolas-Van · Published 2021-10-20 · Updated 2022-08-12 · CVE-2021-41167

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions modern-async versions prior to 1.0.4

Description The issue affects two functions in the modern-async library: forEachSeries and forEachLimit. These functions are supposed to limit the concurrency of certain actions, but they do not. As a result, any code that calls these functions may be written with the expectation of limited concurrency, but this expectation will not be met. This could potentially lead to security issues in other projects.

Recommendations For versions prior to 1.0.4, upgrade to version 1.0.4 to resolve the issue. As a temporary workaround, consider avoiding the use of forEachSeries and forEachLimit functions until the issue is resolved.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2021-41167

GHSA-3PCQ-34W5-P4G2

Affected Products

Modern-Async

References · 8

• 🔥 https://github.com/nicolas-van/modern-async/issues/5 · Exploit
• https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41167 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41167 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3pcq-34w5-p4g2 · Vendor Advisory
• https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2 · Note
• https://github.com/nicolas-van/modern-async · Note
• https://t.me/cibsecurity/30914 · Telegram Post