CVE-2017-16137
Medium
Description
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
SeverityMedium
CVSS5.3
Exploit probability—
ProductDebug
PublishedJun 7, 2018
First seenJun 7, 2018
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- debug_project debug2.6.9, 3.1.0 or later
- debug2.6.9, 3.1.0, 3.2.7, 4.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debug_project debug | 2.0.0 ≤ v < 2.6.9, 3.0.0 ≤ v < 3.1.0 | 2.6.9, 3.1.0 |
| debugnpm | v < 2.6.9, 3.0.0 ≤ v < 3.1.0, 3.2.0 ≤ v < 3.2.7, 4.0.0 ≤ v < 4.3.1 | 2.6.9, 3.1.0, 3.2.7, 4.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.