CVE-2017-20165

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

CVSS v3.0 7.5 HIGH

7.5^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/debug-js/debug/pull/504	Patch Third Party Advisory
https://vuldb.com/?ctiid.217665	Third Party Advisory VDB Entry
https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685	Patch Third Party Advisory
https://github.com/debug-js/debug/releases/tag/3.1.0	Release Notes Third Party Advisory
https://vuldb.com/?id.217665	Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:debug_project:debug::::::node.js::*
	cpe:2.3:a:debug_project:debug::::::node.js::*

Information

Published : 2023-01-09 02:15

Updated : 2023-01-17 09:16

NVD link : CVE-2017-20165

Mitre link : CVE-2017-20165

JSON object : View

CWE

CWE-1333

Inefficient Regular Expression Complexity

Advertisement

Products Affected

debug_project

debug

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/debug-js/debug/pull/504", "name": "https://github.com/debug-js/debug/pull/504", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://vuldb.com/?ctiid.217665", "name": "https://vuldb.com/?ctiid.217665", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "MISC"}, {"url": "https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685", "name": "https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/debug-js/debug/releases/tag/3.1.0", "name": "https://github.com/debug-js/debug/releases/tag/3.1.0", "tags": ["Release Notes", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://vuldb.com/?id.217665", "name": "https://vuldb.com/?id.217665", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-1333"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2017-20165", "ASSIGNER": "cna@vuldb.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2023-01-09T10:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:debug_project:debug:*:*:*:*:*:node.js:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.1.0", "versionStartIncluding": "3.0.0"}, {"cpe23Uri": "cpe:2.3:a:debug_project:debug:*:*:*:*:*:node.js:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.6.9"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-01-17T17:16Z"}