CVE-2017-16137 Regular Expression Denial of Service in debug
MediumCVSS 5.3
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm debug(npm) | < 2.6.9 | 2.6.9 |
| npm debug(npm) | >= 3.0.0, < 3.1.0 | 3.1.0 |
| npm debug(npm) | >= 3.2.0, < 3.2.7 | 3.2.7 |
| npm debug(npm) | >= 4.0.0, < 4.3.1 | 4.3.1 |
| debian/node-debug(Debian:12) | < 3.1.0-1 | 3.1.0-1 |
| debian/node-debug(Debian:13) | < 3.1.0-1 | 3.1.0-1 |
| debian/node-debug(Debian:14) | < 3.1.0-1 | 3.1.0-1 |
| HackerOne debug node module | = <= 2.6.8 || >= 3.0.0 <= 3.0.1 | No fix listed |
| debug project debug | >= 2.0.0, < 2.6.9 | 2.6.9 |
| debug project debug | >= 3.0.0, < 3.1.0 | 3.1.0 |
References
- nvd.nist.gov third-party-advisory
- github.com third-party-advisory
- github.com patch third-party-advisory
- lists.apache.org
- lists.apache.org
- github.com
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com
- Debian Security Tracker CVE-2017-16137 vendor-advisory
- nodesecurity.io third-party-advisory
- [netbeans-commits] 20200429 [jira] [Created] (NETBEANS-4280) cleanup potential security breaches mailing-list
- [netbeans-notifications] 20200429 [GitHub] [netbeans] BradWalker opened a new pull request #2110: [NETBEANS-4280] - cleanup potential security breaches mailing-list