PT-2021-4265 · Npm · Ws

Robert Mclaughlin · Published 2021-05-01 · Updated 2022-06-05 · CVE-2021-32640

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ws versions prior to 7.4.6 ws versions prior to 6.2.2 ws versions prior to 5.2.3

Description A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server, potentially leading to a denial of service. The issue is related to the incorrect interpretation of the Sec-Websocket-Protocol header.

Recommendations For ws versions prior to 7.4.6, update to ws@7.4.6 or later. For ws versions prior to 6.2.2, update to ws@6.2.2 or later. For ws versions prior to 5.2.3, update to ws@5.2.3 or later. As a temporary workaround, consider reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Exploit

Fix

Insufficient Verification of Data Authenticity

Resource Exhaustion

Weakness Enumeration

CWE-345

CWE-400

Related Identifiers

AZL-44670

BDU:2021-04873

CVE-2021-32640

GHSA-6FC8-4GX4-V693

Affected Products

Ws

References · 19

• 🔥 https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693 · Exploit
• https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32640 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32640 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6fc8-4gx4-v693 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32640 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32640 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04873 · Security Note
• https://ubuntu.com/security/CVE-2021-32640 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44670 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32640 · Security Note
• https://github.com/websockets/ws · Note
• https://github.com/websockets/ws/issues/1895 · Note
• https://t.me/cvenotify/15425 · Telegram Post