GHSA-5rqg-jm4f-cqx7

Source

https://github.com/advisories/GHSA-5rqg-jm4f-cqx7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-5rqg-jm4f-cqx7/GHSA-5rqg-jm4f-cqx7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5rqg-jm4f-cqx7

Published

2022-01-10T17:29:53Z

Modified

2022-01-10T19:56:36Z

Summary

Infinite loop causing Denial of Service in colors

Details

colors is a library for including colored text in node.js consoles. Between 07 and 09 January 2022, colors versions 1.4.1, 1.4.2, and 1.4.44-liberty-2 were published including malicious code that caused a Denial of Service due to an infinite loop. Software dependent on these versions experienced the printing of randomized characters to console and an infinite loop resulting in unbound system resource consumption.

Users of colors relying on these specific versions should downgrade to version 1.4.0.

Database specific

{
    "cwe_ids":  [
        "CWE-835"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-01-10T17:29:22Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / colors

Package

Name: colors; View open source insights on deps.dev
Purl: pkg:npm/colors

Affected ranges

Type: SEMVER
Events: Introduced

1.4.1

Last Affected

1.4.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-5rqg-jm4f-cqx7/GHSA-5rqg-jm4f-cqx7.json"

npm / colors

Package

Name: colors; View open source insights on deps.dev
Purl: pkg:npm/colors

Affected ranges

Affected versions

1.*

1.4.44-liberty-2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-5rqg-jm4f-cqx7/GHSA-5rqg-jm4f-cqx7.json"