GHSA-762f-c2wg-m8c8

ghsaUSosv

Denial of Service in protobufjs

view advisory published 2018-10-09Licence: CC-BY-4.0

Versions of `protobufjs` before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid *.proto files. ## Recommendation Update to version 5.0.3, 6.8.6 or later.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-3738US	medium5.5	0.94% (61st)	—	2018-06-07
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-762f-c2wg-m8c8ADVISORY
https://github.com/dcodeIO/protobuf.js/blob/6.8.5/src/parse.js#L27WEB
https://hackerone.com/reports/319576WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-3738ADVISORY
https://www.npmjs.com/advisories/605WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan