CVE-2017-16115 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2017-16115 - High Severity Vulnerability

Vulnerable Library - timespan-2.3.0.tgz

A JavaScript TimeSpan library for node.js (and soon the browser)

path: /tmp/git/angularjs-sample/node_modules/timespan/package.json

Library home page: http://registry.npmjs.org/timespan/-/timespan-2.3.0.tgz

Dependency Hierarchy:

• karma-2.0.0.tgz (Root Library)
  • log4js-2.5.3.tgz
    • loggly-1.1.1.tgz
      • ❌ timespan-2.3.0.tgz (Vulnerable Library)

Vulnerability Details

The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.

Publish Date: 2018-06-07

URL: CVE-2017-16115

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with WhiteSource here