5.5

CVE-2024-27088

Exploit

es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Medikoo ≫ Es5-ext SwPlatformnode.js Version >= 0.10.0 < 0.10.63
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.408
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 0 0.8 0
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2
Patch
https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602
Patch
https://github.com/medikoo/es5-ext/issues/201
Exploit
Issue Tracking
https://github.com/medikoo/es5-ext/security/advisories/GHSA-4gmj-3p3h-gm8h
Patch
Vendor Advisory