Em resumo
- CVE-2017-16100 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta dns-sync (dns-sync project), dns-sync.
- Chance de exploração nos próximos 30 dias (EPSS): 5.1%, maior que 92.4% das vulnerabilidades.
- Correção: atualize para 0.1.1 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| dns-sync | ≤ 0.1.1
| No fix yet |
| dns-sync npm | < 0.1.1
| 0.1.1
|
Description
Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve() method.
Recommendation
- Use an alternative dns resolver
- Do not allow untrusted input into
dns-sync.resolve()
NVD description
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free