7.5high
CVE-2017-16115
Regular Expression Denial of Service in timespan
Also known as GHSA-f523-2f5j-gfcg
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 74%
Public exploits
0
none known
Summary
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
Exploit prediction (EPSS)
1.48% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | timespan | <=2.3.0 | no fix listed |
Affected products
- HackerOne timespan node module
Classification
- Weakness
- CWE-400 Uncontrolled Resource Consumption
References
- github.com /indexzero/TimeSpan.js/issues/10 · x_refsource_MISC, x_transferred
- nodesecurity.io /advisories/533 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-16115 · advisory
- github.com /advisories/GHSA-f523-2f5j-gfcg · advisory
- npmjs.com /advisories/533 · web
Sources
- CVE List: CVE-2017-16115
- GitHub Advisory: GHSA-f523-2f5j-gfcg
- NVD: CVE-2017-16115
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.