PT-2023-10617 · Debug-Js · Debug-Js

Published 2023-01-09 · Updated 2024-05-17 · CVE-2017-20165

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions debug-js debug versions up to 3.0.x debug-js debug version 2.6.x up to 2.6.8

Description A vulnerability has been found in debug-js debug, affecting the useColors function of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity.

Recommendations For versions up to 3.0.x, upgrade to version 3.1.0 to address this issue. For version 2.6.x, upgrade to version 2.6.9 to address this issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2017-20165

GHSA-9VVW-CC9W-F27H

Affected Products

Debug-Js

References · 18

• 🔥 https://github.com/fastify/send · Exploit
• https://github.com/debug-js/debug/releases/tag/3.1.0 · Patch
• https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685 · Patch
• https://github.com/debug-js/debug/pull/504 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-20165 · Security Note
• https://osv.dev/vulnerability/GHSA-9vvw-cc9w-f27h · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-20165 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-20165 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-20165 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-20165 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-20165 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-20165 · Vendor Advisory
• https://github.com/debug-js/debug · Note
• https://github.com/debug-js/debug/releases/tag/2.6.9 · Note
• https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a · Note