GHSA-g78m-2chm-r7qv

Source

https://github.com/advisories/GHSA-g78m-2chm-r7qv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-g78m-2chm-r7qv/GHSA-g78m-2chm-r7qv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g78m-2chm-r7qv

Aliases

CVE-2020-7662
SNYK-JS-WEBSOCKETEXTENSIONS-570623

Published

2020-06-05T16:16:12Z

Modified

2023-11-08T04:04:03.425347Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator

Summary

Regular Expression Denial of Service in websocket-extensions (NPM package)

Details

Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:

Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.

Patches

Users should upgrade to version 0.1.4.

Workarounds

There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating.

References

https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-03T23:10:26Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-400"
    ]
}

References

Affected packages

npm / websocket-extensions

Package

Name: websocket-extensions; View open source insights on deps.dev
Purl: pkg:npm/websocket-extensions

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.1.4