CVE-2017-16100 Command Injection in dns-sync
CriticalCVSS 9.8
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm dns-sync(npm) | < 0.1.1 | 0.1.1 |
| dns-sync project dns-sync | <= 0.1.1 | No fix listed |
| HackerOne dns-sync node module | = All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- github.com
- github.com patch
- github.com patch
- github.com
- www.npmjs.com
- www.npmjs.com
- github.com exploit third-party-advisory
- nodesecurity.io third-party-advisory