En bref
- CVE-2017-16129 est une vulnérabilité MOYENNE (CVSS 5.9) touchant superagent (superagent project), superagent.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.7%, plus élevée que 77.9% des vulnérabilités.
- Correctif : mettre à jour vers 3.7.0 ou plus récent.
Description
Affected versions of superagent do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable to a ZIP bomb attack, where an extremely small ZIP file becomes many orders of magnitude larger when decompressed.
This may result in unrestrained CPU/Memory/Disk consumption, causing a denial of service condition.
Recommendation
Update to version 3.7.0 or later.
NVD description
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free