CVE-2018-7651

2022-10-0316:21:49

Debian Security Bug Tracker

security-tracker.debian.org

node.js

ssri module

regex vulnerability

strict mode

base64 hash

denial of service

unix

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

46.8%

JSON

index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long base64 hash string.

OSVersionArchitecturePackageVersionFilename
Debian12allnode-ssri< 5.2.4-1node-ssri_5.2.4-1_all.deb
Debian11allnode-ssri< 5.2.4-1node-ssri_5.2.4-1_all.deb
Debian999allnode-ssri< 5.2.4-1node-ssri_5.2.4-1_all.deb
Debian13allnode-ssri< 5.2.4-1node-ssri_5.2.4-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	node-ssri	< 5.2.4-1	node-ssri_5.2.4-1_all.deb
Debian	11	all	node-ssri	< 5.2.4-1	node-ssri_5.2.4-1_all.deb
Debian	999	all	node-ssri	< 5.2.4-1	node-ssri_5.2.4-1_all.deb
Debian	13	all	node-ssri	< 5.2.4-1	node-ssri_5.2.4-1_all.deb