In short
- CVE-2017-16129 is a MEDIUM (CVSS 5.9) vulnerability affecting superagent (superagent project), superagent.
- Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 77.9% of all vulnerabilities.
- Fix: update to 3.7.0 or later.
Description
Affected versions of superagent do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable to a ZIP bomb attack, where an extremely small ZIP file becomes many orders of magnitude larger when decompressed.
This may result in unrestrained CPU/Memory/Disk consumption, causing a denial of service condition.
Recommendation
Update to version 3.7.0 or later.
NVD description
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free