PT-2024-6044 · Es5-Ext +2 · Es5-Ext +2

🗓️ 26 Feb 2024 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 2 Views

es5-ext before 0.10.63 may stall and cause denial of service via long names; update to 0.10.63+

Reporter	Title	Published	Views	Family All 33
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	28 Mar 202419:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Eran Hammer cryptiles, PostCSS,Node.js,node-notifier,es5-ext ,MySQL Connectors,json-path and tough-cookie might affect IBM Storage Defender Copy Data Management	12 Dec 202515:25	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	3 May 202410:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana for Synthetic PoP is affected by Multiple Security Vulnerabilities	18 Apr 202413:43	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	22 Jul 202414:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in es5-ext-0.10.53.tgz	20 Sep 202421:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in medikoo es5-ext	26 Feb 202518:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (January 2025)	3 Apr 202523:21	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in medikoo es5-ext and Node.js packages might affect IBM Storage Defender – Resiliency Service (CVE-2024-27088 and CVE-2024-28849)	5 Apr 202417:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	26 Aug 202414:16	–	ibm

Source	Link
github	www.github.com/medikoo/es5-ext/issues/201
github	www.github.com/medikoo/es5-ext/security/advisories/GHSA-4gmj-3p3h-gm8h
github	www.github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602
github	www.github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2024-27088
cve	www.cve.org/CVERecord
bdu	www.bdu.fstec.ru/vul/2024-06866
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
security-tracker	www.security-tracker.debian.org/tracker/source-package/node-es5-ext
osv	www.osv.dev/vulnerability/CVE-2024-27088

04 Sep 2024 00:00Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.5

EPSS0.02005

SSVC

ecmascript five extensions denial of service long names copy function toStringTokens version 0.10.63 remediation recommended