Esta página aún no ha sido traducida a tu idioma. Mostrando contenido en inglés mientras trabajamos en ello.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2017-16119: DoS in fresh Command-Line Tool
Plataforma
nodejs
Componente
fresh
Corregido en
0.5.2
CVE-2017-16119 represents a Denial of Service (DoS) vulnerability within the fresh command-line tool. This vulnerability arises from improper handling of user input, specifically when parsing regular expressions. An attacker can exploit this flaw by providing specially crafted input, leading to a denial of service condition, rendering the tool unresponsive. Affected versions include those prior to 0.5.2; an update to version 0.5.2 or later resolves the issue.
Impacto y Escenarios de Ataquetraduciendo…
The primary impact of CVE-2017-16119 is a denial of service. An attacker can craft malicious input designed to trigger an excessive resource consumption within the fresh tool's regular expression engine. This can lead to the tool becoming unresponsive, preventing legitimate users from utilizing it. The blast radius is limited to the system running the fresh tool, but repeated or widespread exploitation could impact multiple systems if the tool is deployed across an organization. While not directly leading to data exfiltration, the disruption of service can significantly impact workflows and productivity.
Contexto de Explotacióntraduciendo…
CVE-2017-16119 has been publicly disclosed and a proof-of-concept (POC) is likely available, though no active campaigns have been definitively linked to this specific vulnerability. Its CVSS score of 7.5 (HIGH) indicates a significant potential for exploitation. The vulnerability was published on July 24, 2018. While not listed on KEV or EPSS, the ease of exploitation associated with regular expression DoS vulnerabilities warrants careful attention and prompt remediation.
Inteligencia de Amenazas
Estado del Exploit
EPSS
0.33% (56% percentil)
Vector CVSS
¿Qué significan estas métricas?
- Attack Vector
- Red — explotable remotamente por internet. Sin acceso físico ni local. Mayor superficie de ataque.
- Attack Complexity
- Baja — sin condiciones especiales. El atacante puede explotar de forma confiable sin configuraciones raras.
- Privileges Required
- Ninguno — sin autenticación. No se necesitan credenciales para explotar.
- User Interaction
- Ninguna — el ataque es automático y silencioso. La víctima no hace nada.
- Scope
- Sin cambio — el impacto se limita al componente vulnerable.
- Confidentiality
- Ninguno — sin impacto en confidencialidad.
- Integrity
- Ninguno — sin impacto en integridad.
- Availability
- Alto — caída completa o agotamiento de recursos. Denegación de servicio total.
Cronología
- Publicada
- Modificada
- EPSS actualizado
Mitigación y Workaroundstraduciendo…
The recommended mitigation for CVE-2017-16119 is to immediately upgrade to version 0.5.2 or later of the fresh tool. If upgrading is not immediately feasible due to compatibility concerns or system downtime constraints, consider implementing input validation to sanitize user-provided data before it is processed by the regular expression engine. This could involve limiting the complexity of allowed regular expressions or employing a whitelist approach to permitted input patterns. There are no specific WAF or proxy rules applicable to this vulnerability as it resides within the application itself. After upgrading, confirm the fix by attempting to process a known malicious input string and verifying that the tool remains responsive.
Cómo corregirlotraduciendo…
Sin parche oficial disponible. Busca alternativas o monitorea actualizaciones.
Preguntas frecuentestraduciendo…
What is CVE-2017-16119 — DoS in fresh Command-Line Tool?
CVE-2017-16119 is a denial-of-service vulnerability in the fresh command-line tool. Specially crafted user input can trigger a regular expression denial of service, causing the tool to become unresponsive.
Am I affected by CVE-2017-16119 in fresh Command-Line Tool?
You are affected if you are using a version of fresh prior to 0.5.2. Check your version using fresh --version.
How do I fix CVE-2017-16119 in fresh Command-Line Tool?
Upgrade to version 0.5.2 or later of fresh. This resolves the regular expression denial of service vulnerability.
Is CVE-2017-16119 being actively exploited?
While no active campaigns have been definitively linked, the vulnerability is publicly disclosed and a POC is likely available, warranting prompt remediation.
Where can I find the official fresh advisory for CVE-2017-16119?
Refer to the project's release notes or repository for information regarding the fix. Search for 'fresh 0.5.2 release notes' for details.
¿Tu proyecto está afectado?
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Pruébalo ahora — sin cuenta
Sube cualquier manifiesto (composer.lock, package-lock.json, lista de plugins WordPress…) o pega tu lista de componentes. Recibís un reporte de vulnerabilidades al instante. Subir un archivo es solo el primer paso: con una cuenta tenés monitoreo continuo, alertas en tu canal, multi-proyecto y reportes white-label.
Arrastra y suelta tu archivo de dependencias
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...