Описание
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.
A flaw was found in yauzl (Yet Another Unzip Library), a component used in Node.js applications for handling zip files. A remote attacker can exploit an error in how the library processes specific timestamp information within a crafted zip file. This can lead to a denial of service (DoS), causing affected applications to crash and become unavailable.
Отчет
Moderate: This flaw in yauzl can lead to a denial of service in Node.js applications that process zip file uploads and specifically call entry.getLastModDate() on parsed entries. Red Hat products that utilize the affected yauzl library in this manner are susceptible to a process crash when handling a specially crafted zip file containing a malformed NTFS extra field.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Fix deferred | ||
| Node HealthCheck Operator | workload-availability/node-remediation-console-rhel8 | Fix deferred | ||
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Fix deferred | ||
| Red Hat Developer Hub | rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor | Fix deferred | ||
| Red Hat Enterprise Linux 10 | rust | Fix deferred | ||
| Red Hat Enterprise Linux 8 | grafana | Fix deferred | ||
| Red Hat Enterprise Linux 9 | grafana | Out of support scope | ||
| Red Hat Enterprise Linux 9 | rust | Fix deferred | ||
| Red Hat Fuse 7 | yauzl | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | yauzl | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contai ...
EPSS
5.3 Medium
CVSS3