CVE-2015-8854

Опубликовано: 23 янв. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 7.8

EPSS Низкий

Описание

The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."

Ссылки

http://www.openwall.com/lists/oss-security/2016/04/20/11
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO2RMVVZVV6NFTU46B5RYRK7ZCXYARZS/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6BJG6RGDH7ZWVVAUFBFI5L32RSMQN2S/
Mailing List
Third Party Advisory
https://nodesecurity.io/advisories/23
Broken Link
Patch
Vendor Advisory
https://support.f5.com/csp/article/K05052081?utm_source=f5support&amp%3Butm_medium=RSS
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/04/20/11
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO2RMVVZVV6NFTU46B5RYRK7ZCXYARZS/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6BJG6RGDH7ZWVVAUFBFI5L32RSMQN2S/
Mailing List
Third Party Advisory
https://nodesecurity.io/advisories/23
Broken Link
Patch
Vendor Advisory
https://support.f5.com/csp/article/K05052081?utm_source=f5support&amp%3Butm_medium=RSS
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:*

Версия до 0.3.4 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.0102

Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-1333

Связанные уязвимости

CVE-2015-8854

CVSS3: 7.5

ubuntu

больше 8 лет назад

CVE-2015-8854

CVSS3: 7.5

debian

больше 8 лет назад

The marked package before 0.3.4 for Node.js allows attackers to cause ...

GHSA-hjcp-j389-59ff

CVSS3: 7.5

github

больше 7 лет назад

Regular Expression Denial of Service in marked

BDU:2022-01720

CVSS3: 7.5

fstec

больше 10 лет назад

Уязвимость программной платформы Node.js, связанная с ошибками управления ресурсом, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 76%

0.0102

Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-1333