यह पृष्ठ अभी तक आपकी भाषा में अनुवादित नहीं हुआ है। हम इस पर काम कर रहे हैं, तब तक अंग्रेज़ी में सामग्री दिखाई जा रही है।
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2017-16119: DoS in fresh Command-Line Tool
प्लेटफ़ॉर्म
nodejs
घटक
fresh
में ठीक किया गया
0.5.2
CVE-2017-16119 represents a Denial of Service (DoS) vulnerability within the fresh command-line tool. This vulnerability arises from improper handling of user input, specifically when parsing regular expressions. An attacker can exploit this flaw by providing specially crafted input, leading to a denial of service condition, rendering the tool unresponsive. Affected versions include those prior to 0.5.2; an update to version 0.5.2 or later resolves the issue.
प्रभाव और हमले की स्थितियाँअनुवाद हो रहा है…
The primary impact of CVE-2017-16119 is a denial of service. An attacker can craft malicious input designed to trigger an excessive resource consumption within the fresh tool's regular expression engine. This can lead to the tool becoming unresponsive, preventing legitimate users from utilizing it. The blast radius is limited to the system running the fresh tool, but repeated or widespread exploitation could impact multiple systems if the tool is deployed across an organization. While not directly leading to data exfiltration, the disruption of service can significantly impact workflows and productivity.
शोषण संदर्भअनुवाद हो रहा है…
CVE-2017-16119 has been publicly disclosed and a proof-of-concept (POC) is likely available, though no active campaigns have been definitively linked to this specific vulnerability. Its CVSS score of 7.5 (HIGH) indicates a significant potential for exploitation. The vulnerability was published on July 24, 2018. While not listed on KEV or EPSS, the ease of exploitation associated with regular expression DoS vulnerabilities warrants careful attention and prompt remediation.
खतरा खुफिया
एक्सप्लॉइट स्थिति
EPSS
0.33% (56% शतमक)
CVSS वेक्टर
इन मेट्रिक्स का क्या मतलब है?
- Attack Vector
- नेटवर्क — इंटरनेट के माध्यम से दूरस्थ रूप से शोषण योग्य। कोई भौतिक या स्थानीय पहुंच आवश्यक नहीं।
- Attack Complexity
- निम्न — कोई विशेष शर्त नहीं। विश्वसनीय रूप से शोषण योग्य।
- Privileges Required
- कोई नहीं — बिना प्रमाणीकरण के शोषण योग्य।
- User Interaction
- कोई नहीं — स्वचालित और मूक हमला। पीड़ित कुछ नहीं करता।
- Scope
- अपरिवर्तित — प्रभाव केवल कमज़ोर घटक तक सीमित।
- Confidentiality
- कोई नहीं — गोपनीयता पर कोई प्रभाव नहीं।
- Integrity
- कोई नहीं — अखंडता पर कोई प्रभाव नहीं।
- Availability
- उच्च — पूर्ण क्रैश या संसाधन समाप्ति। पूर्ण सेवा से इनकार।
समयरेखा
- प्रकाशित
- संशोधित
- EPSS अद्यतन
शमन और वर्कअराउंडअनुवाद हो रहा है…
The recommended mitigation for CVE-2017-16119 is to immediately upgrade to version 0.5.2 or later of the fresh tool. If upgrading is not immediately feasible due to compatibility concerns or system downtime constraints, consider implementing input validation to sanitize user-provided data before it is processed by the regular expression engine. This could involve limiting the complexity of allowed regular expressions or employing a whitelist approach to permitted input patterns. There are no specific WAF or proxy rules applicable to this vulnerability as it resides within the application itself. After upgrading, confirm the fix by attempting to process a known malicious input string and verifying that the tool remains responsive.
कैसे ठीक करेंअनुवाद हो रहा है…
कोई आधिकारिक पैच उपलब्ध नहीं है। वैकल्पिक समाधान खोजें या अपडेट की निगरानी करें।
अक्सर पूछे जाने वाले सवालअनुवाद हो रहा है…
What is CVE-2017-16119 — DoS in fresh Command-Line Tool?
CVE-2017-16119 is a denial-of-service vulnerability in the fresh command-line tool. Specially crafted user input can trigger a regular expression denial of service, causing the tool to become unresponsive.
Am I affected by CVE-2017-16119 in fresh Command-Line Tool?
You are affected if you are using a version of fresh prior to 0.5.2. Check your version using fresh --version.
How do I fix CVE-2017-16119 in fresh Command-Line Tool?
Upgrade to version 0.5.2 or later of fresh. This resolves the regular expression denial of service vulnerability.
Is CVE-2017-16119 being actively exploited?
While no active campaigns have been definitively linked, the vulnerability is publicly disclosed and a POC is likely available, warranting prompt remediation.
Where can I find the official fresh advisory for CVE-2017-16119?
Refer to the project's release notes or repository for information regarding the fix. Search for 'fresh 0.5.2 release notes' for details.
क्या आपका प्रोजेक्ट प्रभावित है?
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
अभी आज़माएँ — no खाता
scanZone.subtitle
अपनी डिपेंडेंसी फ़ाइल ड्रैग और ड्रॉप करें
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...