PT-2024-29484 · Unknown · Tf2-Item-Format

Piman51277 · Published 2024-07-23 · Updated 2024-07-24 · CVE-2024-41655

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tf2-item-format versions 4.2.6 through 5.9.13

Description The issue is related to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This can be exploited by an attacker to perform DoS attacks on any service that uses tf2-item-format to parse user input.

Recommendations For versions 4.2.6 through 5.8.10, upgrade the package to version 5.9.14. For version 5.9.13, upgrade the package to version 5.9.14. For versions prior to 5.9.14, consider upgrading to version 5.9.14 to resolve the issue. If upgrading to v5 is not possible, consider forking the module repository and implementing the fix detailed in the v4 to v5 migration guide.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

CWE-624

Related Identifiers

CVE-2024-41655

GHSA-8H55-Q5QQ-P685

Affected Products

Tf2-Item-Format

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41655.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-41655 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8h55-q5qq-p685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41655 · Security Note
• https://github.com/danocmx/node-tf2-item-format/commit/5cffcc16a9261d6a937bda72bfe6830e02e31eec · Note
• https://github.com/danocmx/node-tf2-item-format/security/advisories/GHSA-8h55-q5qq-p685 · Note
• https://github.com/danocmx/node-tf2-item-format · Note
• https://github.com/danocmx/node-tf2-item-format/releases/tag/v5.9.14 · Note
• https://t.me/cvedetector/1510 · Telegram Post