Описание
Command Injection in dns-sync
Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve() method.
Recommendation
- Use an alternative dns resolver
- Do not allow untrusted input into
dns-sync.resolve()
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2017-16100
- https://github.com/skoranga/node-dns-sync/issues/1
- https://github.com/skoranga/node-dns-sync/issues/1)
- https://github.com/skoranga/node-dns-sync/issues/5
- https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d
- https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d)))
- https://github.com/advisories/GHSA-jcw8-r9xm-32c6
- https://www.npmjs.com/advisories/153
- https://www.npmjs.com/advisories/523
Пакеты
Наименование
dns-sync
npm
Затронутые версииВерсия исправления
< 0.1.1
0.1.1
Связанные уязвимости
CVSS3: 9.8
nvd
больше 7 лет назад
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.