GHSA-5RWJ-J5M3-3CHJ高危已审查

Missing Release of Memory after Effective Lifetime in detect-character-encoding

OSV 1.4.0 · github-reviewed · 修改于 2021-10-21 22:28

发布时间

2021-09-02 02:25

GitHub 审查时间

2021-09-01 03:58

NVD 发布时间

2021-09-01 02:15

源文件

advisories/github-reviewed/2021/09/GHSA-5rwj-j5m3-3chj/GHSA-5rwj-j5m3-3chj.json

公告说明

Impact

In detect-character-encoding v0.3.0 and earlier, allocated memory is not released.

Patches

The problem has been patched in detect-character-encoding v0.3.1.

CVSS score

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C

Base Score: 7.5 (High) Temporal Score: 7.2 (High)

Since detect-character-encoding is a library, the scoring is based on the “reasonable worst-case implementation scenario”, namely, using detect-character-encoding in a program accessible over the internet which becomes unavailable when running out of memory. Depending on your specific implementation, the vulnerability’s severity in your program may be different.

Proof of concept

const express = require("express");
const detectCharacterEncoding = require("detect-character-encoding");

const app = express();

app.get("/", (req, res) => {
  detectCharacterEncoding(Buffer.from("foo"));

  res.end();
});

app.listen(3000);

hey -n 1000000 http://localhost:3000 (hey) causes the Node.js process to consume more and more memory.

References

标识信息

别名 / CVE

CVE-2021-39176

CWE

CWE-401

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

原始 OSV JSON

{
  "id": "GHSA-5rwj-j5m3-3chj",
  "aliases": [
    "CVE-2021-39176"
  ],
  "details": "### Impact\n\nIn detect-character-encoding v0.3.0 and earlier, allocated memory is not released.\n\n### Patches\n\nThe problem has been patched in [detect-character-encoding v0.3.1](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1).\n\n### CVSS score\n\n[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)\n\nBase Score: 7.5 (High)\nTemporal Score: 7.2 (High)\n\nSince detect-character-encoding is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, using detect-character-encoding in a program accessible over the internet which becomes unavailable when running out of memory. Depending on your specific implementation, the vulnerability’s severity in your program may be different.\n\n### Proof of concept\n\n```js\nconst express = require(\"express\");\nconst detectCharacterEncoding = require(\"detect-character-encoding\");\n\nconst app = express();\n\napp.get(\"/\", (req, res) => {\n  detectCharacterEncoding(Buffer.from(\"foo\"));\n\n  res.end();\n});\n\napp.listen(3000);\n```\n\n`hey -n 1000000 http://localhost:3000` ([`hey`](https://github.com/rakyll/hey)) causes the Node.js process to consume more and more memory.\n\n### References\n\n- https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588\n- https://github.com/sonicdoe/detect-character-encoding/pull/6",
  "summary": "Missing Release of Memory after Effective Lifetime in detect-character-encoding",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.1"
            }
          ]
        }
      ],
      "package": {
        "name": "detect-character-encoding",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2021-10-21T14:28:07Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "published": "2021-09-01T18:25:16Z",
  "references": [
    {
      "url": "https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-5rwj-j5m3-3chj",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39176",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/sonicdoe/detect-character-encoding/pull/6",
      "type": "WEB"
    },
    {
      "url": "https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588",
      "type": "WEB"
    },
    {
      "url": "https://github.com/sonicdoe/detect-character-encoding",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2021-08-31T18:15:00Z",
    "github_reviewed_at": "2021-08-31T19:58:46Z"
  }
}