CVE-2018-3738 Denial of Service in protobufjs
MediumCVSS 5.5
EPSS 0.94%
- Published
- Updated
- Exploit status
- No public exploit known
Description
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm protobufjs(npm) | >= 6.0.0, < 6.8.6 | 6.8.6 |
| npm protobufjs(npm) | < 5.0.3 | 5.0.3 |
| protobufjs project protobufjs | <= 6.8.5 | No fix listed |
| HackerOne protobufjs node module | = Versions up to and including 6.8.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- hackerone.com exploit third-party-advisory
- github.com
- www.npmjs.com
- github.com