Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

BUG: file-type vulnerable to Infinite Loop #830

Closed
palisadoes opened this issue Dec 30, 2022 · 1 comment · Fixed by #841
Closed

BUG: file-type vulnerable to Infinite Loop #830

palisadoes opened this issue Dec 30, 2022 · 1 comment · Fixed by #841
Assignees
@prathamesh-mutkure
Labels
bug Something isn't working

Comments

@palisadoes
Copy link
Contributor

Describe the bug

An issue was discovered in the file-type package from 13.0.0 until 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack when used on a web server.

Update package-lock.json

image

To Reproduce
See above

Expected behavior
No vulnerabiltiy present

Actual behavior
See above

Screenshots
See above

Additional details
@palisadoes palisadoes added the bug Something isn't working label Dec 30, 2022
@github-actions github-actions bot added the unapproved Unapproved for Pull Request label Dec 30, 2022
@prathamesh-mutkure
Copy link
Contributor

prathamesh-mutkure commented Jan 2, 2023 •
edited

I think I can work on this issue, can any maintainer assign it to me?

@palisadoes palisadoes removed the unapproved Unapproved for Pull Request label Jan 2, 2023
@prathamesh-mutkure prathamesh-mutkure mentioned this issue Jan 3, 2023
Closed
@palisadoes palisadoes mentioned this issue Jan 3, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@prathamesh-mutkure prathamesh-mutkure

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
2 participants
@palisadoes @prathamesh-mutkure