Lucene search

VulDBCVE-2020-36661

HistoryFeb 12, 2023 - 9:15 p.m.

CVE-2020-36661

2023-02-1221:15:10

CWE-1333

VulDB

web.nvd.nist.gov

cve-2020-36661

kong lua-multipart

vulnerability

upgrade

regex complexity

nvd

vdb-220642

CVSS2

2.7

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

55.6%

JSON

A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complexity. Upgrading to version 0.5.9-1 is able to address this issue. The patch is identified as d632e5df43a2928fd537784a99a79dec288bf01b. It is recommended to upgrade the affected component. VDB-220642 is the identifier assigned to this vulnerability.

Affected configurations

Nvd

Vulners

Node

konghqmultipartMatch0.5.8-1lua

VendorProductVersionCPE
konghqmultipart0.5.8-1cpe:2.3:a:konghq:multipart:0.5.8-1:*:*:*:*:lua:*:*

Vendor	Product	Version	CPE
konghq	multipart	0.5.8-1	cpe:2.3:a:konghq:multipart:0.5.8-1:::::lua::

CNA Affected

[
  {
    "vendor": "Kong",
    "product": "lua-multipart",
    "versions": [
      {
        "version": "0.5.8-1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/Kong/lua-multipart/commit/d632e5df43a2928fd537784a99a79dec288bf01b

github.com/Kong/lua-multipart/pull/34

github.com/Kong/lua-multipart/releases/tag/0.5.9-1

vuldb.com/?ctiid.220642

vuldb.com/?id.220642

CVSS2

2.7

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

55.6%

JSON

Related for CVE-2020-36661