CVE-2023-50728

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-50728
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-50728.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-50728
Aliases
Published
2023-12-15T21:59:00.312Z
Modified
2026-04-10T05:07:27.775391Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H CVSS Calculator
Summary
Unauthenticated Denial of Service in the octokit/webhooks library
Details

octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases. The resulting request was found to cause an uncaught exception that ends the nodejs process. The bug is fixed in octokit/webhooks.js 9.26.3, 10.9.2, 11.1.2, and 12.0.4, app.js 14.02, octokit.js 3.1.2, and Protobot 12.3.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-755"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50728.json"
}
References

Affected packages

Git
github.com/octokit/app.js

Affected ranges

Type
GIT
Repo
https://github.com/octokit/app.js
Events
Introduced
7c48a3af5d572b6b9ae0f97accb630aad2e26a14
Fixed
3583abb2e29baf44039982d1d85eefe30308f4b9

Affected versions

v12.*
v12.0.0
v12.0.1
v12.0.2
v12.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-50728.json"
github.com/octokit/octokit.js

Affected ranges

Type
GIT
Repo
https://github.com/octokit/octokit.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b59da8030f23dcd6b70d01a5d02e49fba600b4e8
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.1.2"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.8.1
v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.19
v2.0.2
v2.0.20
v2.0.21
v2.0.22
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v3.*
v3.0.0
v3.1.0
v3.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-50728.json"
github.com/octokit/webhooks.js

Affected ranges

Type
GIT
Repo
https://github.com/octokit/webhooks.js
Events
Introduced
c9b66b11985e5ff6ce8007e7e56eac01555e293c
Fixed
a674dd6ea8adb5a36b98dd83cbf5b19d2b47d2ef
Database specific 
{
    "versions": [
        {
            "introduced": "9.26.0"
        },
        {
            "fixed": "9.26.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/octokit/webhooks.js
Events
Introduced
b2f4d18f163ef74032875306b5539dbb472c910b
Fixed
09ca15c433e2d60faa7e4fc4101b1a54febec4c9
Database specific 
{
    "versions": [
        {
            "introduced": "10.9.0"
        },
        {
            "fixed": "10.9.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/octokit/webhooks.js
Events
Introduced
0ec994a4568c4fb32efdd663977e18af77900f16
Fixed
3577346acd24e185ba7aa96ec339aa5517a5f9e7
Database specific 
{
    "versions": [
        {
            "introduced": "11.1.0"
        },
        {
            "fixed": "11.1.2"
        }
    ]
}

Affected versions

v11.*
v11.1.0
v11.1.1
v9.*
v9.26.0
v9.26.1
v9.26.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-50728.json"
github.com/probot/probot

Affected ranges

Type
GIT
Repo
https://github.com/probot/probot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
05179ffe7375f4573610060b15065d6091ab6999
Introduced
76b1f8fcb20d2aea047b5b3ec0d850c02ab53021
Fixed
630d78e34780c8f64702a15b42854c2fa0f9af54
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
02d81f886cf8f4b7725523a1c4958127015dcfb0
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.0.1"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.9.2"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "12.3.3"
        }
    ]
}

Affected versions

7.*
7.1.2
v0.*
v0.11.0
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.3.2
v0.4.0
v0.4.1
v0.5.0
v0.7.0
v0.7.5
v0.8.0
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.1.0
v10.*
v10.1.1
v10.1.2
v10.1.3
v10.1.4
v10.1.5
v10.10.0
v10.10.1
v10.10.2
v10.11.0
v10.12.0
v10.13.0
v10.14.0
v10.14.1
v10.15.0
v10.16.0
v10.17.0
v10.17.1
v10.17.2
v10.17.3
v10.18.0
v10.19.0
v10.2.0
v10.3.0
v10.4.0
v10.4.1
v10.5.0
v10.6.0
v10.7.0
v10.7.1
v10.8.0
v10.8.1
v10.9.0
v10.9.1
v10.9.2
v10.9.3
v10.9.4
v10.9.5
v11.*
v11.0.0
v11.0.0-beta.4
v11.0.1
v11.0.2
v11.0.3
v11.0.4
v11.0.5
v11.0.6
v11.1.0
v11.1.1
v11.2.0
v11.2.1
v11.2.2
v11.2.3
v11.2.4
v11.3.0
v11.3.1
v11.3.2
v11.4.0
v11.4.1
v12.*
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.1.4
v12.2.0
v12.2.1
v12.2.2
v12.2.3
v12.2.4
v12.2.5
v12.2.6
v12.2.7
v12.2.8
v12.2.9
v12.3.0
v12.3.1
v12.3.2
v12.3.3
v13.*
v13.0.0
v13.0.1
v13.0.2
v13.1.0
v13.1.1
v13.1.2
v13.2.0
v13.2.1
v13.2.2
v13.3.0
v13.3.1
v13.3.10
v13.3.2
v13.3.3
v13.3.4
v13.3.5
v13.3.6
v13.3.7
v13.3.8
v13.3.9
v13.4.0
v13.4.1
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v14.*
v14.0.0
v14.0.1
v2.*
v2.0.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v4.*
v4.0.0
v4.1.0
v5.*
v5.0.0
v6.*
v6.1.0
v6.2.0
v7.*
v7.0.0
v7.0.0@7.x
v7.2.0
v7.2.0@7.x
v7.3.0
v7.3.0@7.x
v7.4.0
v7.4.0@7.x
v7.5.0
v7.5.0@7.x
v7.5.1
v7.5.1@7.x
v9.*
v9.0.0
v9.0.0@next
v9.0.1
v9.0.2
v9.1.0
v9.1.1
v9.10.0
v9.10.1
v9.10.2
v9.11.0
v9.11.1
v9.11.2
v9.11.3
v9.11.4
v9.11.5
v9.11.6
v9.11.7
v9.12.0
v9.13.0
v9.13.1
v9.13.2
v9.14.0
v9.14.1
v9.15.0
v9.2.0
v9.2.1
v9.2.10
v9.2.11
v9.2.12
v9.2.13
v9.2.14
v9.2.15
v9.2.16
v9.2.17
v9.2.18
v9.2.19
v9.2.2
v9.2.20
v9.2.3
v9.2.4
v9.2.5
v9.2.6
v9.2.7
v9.2.8
v9.2.9
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.3.4
v9.4.0
v9.5.0
v9.5.1
v9.5.2
v9.5.3
v9.6.0
v9.6.1
v9.6.2
v9.6.3
v9.6.4
v9.6.5
v9.6.6
v9.7.0
v9.8.0
v9.8.1
v9.9.0
v9.9.1
v9.9.2
v9.9.3
v9.9.4
v9.9.5
v9.9.6
v9.9.7
v9.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-50728.json"