Lucene search

GitHub Advisory DatabaseGHSA-8M45-2RJM-J347

HistoryApr 17, 2024 - 6:21 p.m.

Handling untrusted input can result in a crash, leading to loss of availability / denial of service

2024-04-1718:21:18

CWE-119

GitHub Advisory Database

github.com

input handling

crash risk

availability loss

web3.js

memory exhaustion

server security

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Using particular inputs with @solana/web3.js will result in memory exhaustion (OOM).

If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability.

Affected configurations

Vulners

Node

solanarbpfRange<1.0.1

solanarbpfRange<1.1.2

solanarbpfRange<1.2.8

solanarbpfMatch1.3.0

solanarbpfMatch1.4.0

solanarbpfMatch1.5.0

solanarbpfMatch1.6.0

solanarbpfRange<1.7.2

solanarbpfMatch1.8.0

solanarbpfRange<1.9.2

solanarbpfRange<1.10.2

solanarbpfMatch1.11.0

solanarbpfMatch1.12.0

solanarbpfMatch1.13.0

solanarbpfMatch1.14.0

solanarbpfMatch1.15.0

solanarbpfRange<1.16.2

solanarbpfMatch1.17.0

solanarbpfMatch1.18.0

solanarbpfMatch1.19.0

solanarbpfRange<1.20.3

solanarbpfMatch1.21.0

solanarbpfMatch1.22.0

solanarbpfMatch1.23.0

solanarbpfRange<1.24.3

solanarbpfMatch1.25.0

solanarbpfMatch1.26.0

solanarbpfMatch1.27.0

solanarbpfMatch1.28.0

solanarbpfRange<1.29.4

solanarbpfRange<1.30.3

solanarbpfMatch1.31.0

solanarbpfRange<1.32.2

solanarbpfMatch1.33.0

solanarbpfMatch1.34.0

solanarbpfRange<1.35.2

solanarbpfMatch1.36.0

solanarbpfRange<1.37.3

solanarbpfMatch1.38.0

solanarbpfRange<1.39.2

solanarbpfRange<1.40.2

solanarbpfRange<1.41.11

solanarbpfMatch1.42.0

solanarbpfRange<1.43.7

solanarbpfRange<1.44.4

solanarbpfMatch1.45.0

solanarbpfMatch1.46.0

solanarbpfRange<1.47.5

solanarbpfMatch1.48.0

solanarbpfMatch1.49.0

solanarbpfRange<1.50.2

solanarbpfMatch1.51.0

solanarbpfMatch1.52.0

solanarbpfMatch1.53.0

solanarbpfRange<1.54.2

solanarbpfMatch1.55.0

solanarbpfRange<1.56.3

solanarbpfMatch1.57.0

solanarbpfMatch1.58.0

solanarbpfRange<1.59.2

solanarbpfMatch1.60.0

solanarbpfRange<1.61.2

solanarbpfRange<1.62.2

solanarbpfRange<1.63.2

solanarbpfMatch1.64.0

solanarbpfMatch1.65.0

solanarbpfRange<1.66.6

solanarbpfRange<1.67.3

solanarbpfRange<1.68.2

solanarbpfMatch1.69.0

solanarbpfRange<1.70.4

solanarbpfMatch1.71.0

solanarbpfMatch1.72.0

solanarbpfRange<1.73.5

solanarbpfMatch1.74.0

solanarbpfMatch1.75.0

solanarbpfMatch1.76.0

solanarbpfRange<1.77.4

solanarbpfRange<1.78.8

solanarbpfMatch1.79.0

solanarbpfMatch1.80.0

solanarbpfMatch1.81.0

solanarbpfMatch1.82.0

solanarbpfMatch1.83.0

solanarbpfMatch1.84.0

solanarbpfMatch1.85.0

solanarbpfMatch1.86.0

solanarbpfRange<1.87.7

solanarbpfMatch1.88.0

solanarbpfRange<1.89.2

solanarbpfRange<1.90.2

solanarbpfRange<1.91.3

CPENameOperatorVersion
@solana/web3.jslt1.0.1
@solana/web3.jslt1.1.2
@solana/web3.jslt1.2.8
@solana/web3.jseq1.3.0
@solana/web3.jseq1.4.0
@solana/web3.jseq1.5.0
@solana/web3.jseq1.6.0
@solana/web3.jslt1.7.2
@solana/web3.jseq1.8.0
@solana/web3.jslt1.9.2

Name	Operator	Version
@solana/web3.js	lt	1.0.1
@solana/web3.js	lt	1.1.2
@solana/web3.js	lt	1.2.8
@solana/web3.js	eq	1.3.0
@solana/web3.js	eq	1.4.0
@solana/web3.js	eq	1.5.0
@solana/web3.js	eq	1.6.0
@solana/web3.js	lt	1.7.2
@solana/web3.js	eq	1.8.0
@solana/web3.js	lt	1.9.2

Rows per page:

1-10 of 921

References

github.com/advisories/GHSA-8m45-2rjm-j347

github.com/solana-labs/solana-web3.js/commit/77d935221a4805107b20b60ae7c1148725e4e2d0

github.com/solana-labs/solana-web3.js/security/advisories/GHSA-8m45-2rjm-j347

nvd.nist.gov/vuln/detail/CVE-2024-30253

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for GHSA-8M45-2RJM-J347