In short
- CVE-2017-16100 is a CRITICAL (CVSS 9.8) vulnerability affecting dns-sync (dns-sync project), dns-sync.
- Chance of exploitation in the next 30 days (EPSS): 5.1%, higher than 92.3% of all vulnerabilities.
- Fix: update to 0.1.1 or later.
| Package | Affected versions | Patched versions |
|---|
| dns-sync | ≤ 0.1.1
| No fix yet |
| dns-sync npm | < 0.1.1
| 0.1.1
|
Description
Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve() method.
Recommendation
- Use an alternative dns resolver
- Do not allow untrusted input into
dns-sync.resolve()
NVD description
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free