GHSA-pv6r-vchh-cxg9

Source

https://github.com/advisories/GHSA-pv6r-vchh-cxg9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-pv6r-vchh-cxg9/GHSA-pv6r-vchh-cxg9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pv6r-vchh-cxg9

Published

2020-09-03T20:42:09Z

Modified

2020-08-31T18:50:15Z

Summary

Denial of Service in apostrophe

Details

Versions of apostrophe prior to 2.97.1 are vulnerable to Denial of Service. The apostrophe-jobs module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to start a large number of jobs and exhaust system memory.

Recommendation

Upgrade to version 2.97.1 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:50:15Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

https://www.npmjs.com/advisories/1183

Affected packages

npm / apostrophe

Package

Name: apostrophe; View open source insights on deps.dev
Purl: pkg:npm/apostrophe

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.97.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-pv6r-vchh-cxg9/GHSA-pv6r-vchh-cxg9.json"