PT-2022-28201 · Colors · Coloros

Published 2022-01-10 · Updated 2022-01-10

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions colors versions 1.4.1 through 1.4.44-liberty-2

Description The issue is related to malicious code in certain versions of the colors library, which causes a Denial of Service due to an infinite loop. This results in the printing of randomized characters to the console and unbound system resource consumption.

Recommendations For colors versions 1.4.1 through 1.4.44-liberty-2, downgrade to version 1.4.0 to resolve the issue.

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

GHSA-5RQG-JM4F-CQX7

Affected Products

Coloros

References · 5

• https://osv.dev/vulnerability/GHSA-5rqg-jm4f-cqx7 · Vendor Advisory
• https://github.com/Marak/colors.js/commit/137c6dae3339e97f4bbc838c221803c363b0a9fd · Note
• https://github.com/Marak/colors.js/commit/5d2d242f656103ac38086d6b26433a09f1c38c75 · Note
• https://github.com/Marak/colors.js · Note
• https://github.com/Marak/colors.js/commit/6bc50e79eeaa1d87369bb3e7e608ebed18c5cf26 · Note