GHSA-6q4w-3wp4-q5wf

Source

https://github.com/advisories/GHSA-6q4w-3wp4-q5wf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-6q4w-3wp4-q5wf/GHSA-6q4w-3wp4-q5wf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6q4w-3wp4-q5wf

Aliases

CVE-2021-27191

Published

2021-04-13T15:15:57Z

Modified

2023-11-08T04:05:23.815655Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Denial of Service in get-ip-range

Details

The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion. Update get-ip-range dependency to 4.0.0 or above.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-19T22:50:19Z",
    "severity": "HIGH",
    "nvd_published_at": "2021-02-11T18:15:00Z",
    "cwe_ids": [
        "CWE-400"
    ]
}

References

Affected packages

npm / get-ip-range

Package

Name: get-ip-range; View open source insights on deps.dev
Purl: pkg:npm/get-ip-range

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-6q4w-3wp4-q5wf/GHSA-6q4w-3wp4-q5wf.json"