要点
- CVE-2017-16100 是影响 dns-sync (dns-sync project), dns-sync 的严重 (CVSS 9.8)漏洞。
- 未来 30 天内被利用的概率（EPSS）：5.1%，高于 92.4% 的漏洞。
- 修复：升级到 0.1.1 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| dns-sync | ≤ 0.1.1
| No fix yet |
| dns-sync npm | < 0.1.1
| 0.1.1
|
Description
Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve() method.
Recommendation
- Use an alternative dns resolver
- Do not allow untrusted input into
dns-sync.resolve()
NVD description
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free