En resumen
- CVE-2017-16100 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a dns-sync (dns-sync project), dns-sync.
- Probabilidad de explotación en los próximos 30 días (EPSS): 5.1%, mayor que el 92.4% de las vulnerabilidades.
- Solución: actualizar a 0.1.1 o posterior.
| Package | Affected versions | Patched versions |
|---|
| dns-sync | ≤ 0.1.1
| No fix yet |
| dns-sync npm | < 0.1.1
| 0.1.1
|
Description
Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve() method.
Recommendation
- Use an alternative dns resolver
- Do not allow untrusted input into
dns-sync.resolve()
NVD description
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free