PT-2024-40224 · Unknown · Nodemailer
Published
2024-01-31
·
Updated
2024-01-31
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions:
nodemailer (affected versions not specified)
Description:
A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter
attachDataUrls set, causing the event loop to become stuck. Another flaw was found when nodemailer tries to parse attachments with an embedded file, also causing the event loop to become stuck. The issue involves specific regex patterns, including /^data:((?:[^;]*;)*(?:[^,]*)),(.*)$/ and /(<imgb[^>]* srcs*=[s"']*)(data:([^;]+);[^"'>s]+)/, and affects functions such as compile, getAttachments, processDataUrl, and convertDataImages. A specially crafted email can cause this problem, leading to the event loop becoming stuck.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nodemailer