Protobufjs Denial of Service Vulnerability

protobufjs is a JavaScript implementation that can serialize structured data . A denial of service vulnerability exists in protobufjs. An attacker can exploit this vulnerability to cause a denial of service with an invalid specially crafted .proto file...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

Code injection

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

@accordproject/cicero-cli (>=0.2.48, <=0.3.16), @accordproject/cicero-common (>=0.2.50, <=0.2.54) +114 more potentially affected by CVE-2018-3738 via protobufjs (>=6.1.0, <=6.8.5)

protobufjs NPM version =6.1.0, =0.2.48, =0.2.50, =0.2.46, =0.2.46, =0.2.46, =0.0.37, =0.0.36, =0.0.37, =0.1.0, =1.0.0, =2.2.0 - @ibmblockchain/composer-playground 0.16.2 and more Source cves: CVE-2018-3738 Source advisory: MEND:CVE-2018-3738...

CVE-2018-3738

protobufjs is affected by a Denial of Service via a regular expression denial of service when parsing crafted invalid .proto files. Affected versions are prior to 5.0.3 and prior to 6.8.6. Remediation: upgrade to protobufjs 5.0.3 or later, or 6.8.6 or later. The issue arises from ReDoS during par...

@adriantombu/openstack-swift (>=0.0.1, <=0.0.5), @alicloud/fun (>=2.7.1, <=2.16.5) +638 more potentially affected by CVE-2018-3738 via protobufjs (>=2.0.4, <=5.0.2)

protobufjs NPM version =2.0.4, =0.0.1, =2.7.1, =0.1.0, =1.3.0, =5.0.0-beta.5, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.2.4-20180621213746, =0.1.0-20180815155955, =0.0.6, =0.5.0, =1.3.329, =3.7.539, =3.7.550 and more Source cves: CVE-2018-3738 Source...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

PT-2018-16161 · Protobufjs · Protobufjs

Name of the Vulnerable Software and Affected Versions: protobufjs versions prior to 5.0.3 protobufjs versions prior to 6.8.6 Description: The issue concerns a regular expression denial of service when parsing crafted invalid .proto files, potentially leading to ReDoS. Recommendations: Update to...

CVE-2018-3738: Allocation of Resources Without Limits or Throttling

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

Denial of Service

Overview Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to denial of service when parsing crafted invalid .proto files. Recommendation Update to version 5.0.3, 6.8.6 or later. References - https://github.com/dcodeIO/protobuf.js/blob/6.8.5/src/parse.jsL27 - HackerOne Report - GitHub...

Regular Expression Denial Of Service (ReDoS)

protobufjs is vulnerable to regular expression denial of service ReDoS. The attack can be triggered when the attacker parses or loads .proto file sources using malicious file or regex or string...