CVE-2017-16129
First published: Thu Jun 07 2018(Updated: )
Affected versions of `superagent` do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable to a [ZIP bomb](https://en.wikipedia.org/wiki/Zip_bomb) attack, where an extremely small ZIP file becomes many orders of magnitude larger when decompressed. This may result in unrestrained CPU/Memory/Disk consumption, causing a denial of service condition. ## Recommendation Update to version 3.7.0 or later.
Credit: support@hackerone.com support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/superagent | <3.7.0 | 3.7.0 |
| Superagent Project Superagent | <3.7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-16129
- https://github.com/visionmedia/superagent/issues/1259
- https://en.wikipedia.org/wiki/Zip_bomb
- https://github.com/advisories/GHSA-8225-6cvr-8pqp (Advisory)
- https://www.npmjs.com/advisories/479
- https://nodesecurity.io/advisories/479
- https://exchange.xforce.ibmcloud.com/vulnerabilities/135781
- https://www.ibm.com/support/pages/node/6214472 (Advisory)
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2017-16129.
What is the severity of CVE-2017-16129?
The severity of CVE-2017-16129 is high (5.9).
How does the ZIP bomb attack affect the vulnerable software?
The ZIP bomb attack affects the vulnerable software by exploiting a lack of post-decompression size checking of ZIP compressed HTTP responses. This allows an extremely small ZIP file to become many orders of magnitude larger when decompressed, leading to a denial of service (DoS) condition.
Which versions of the superagent module are affected by CVE-2017-16129?
Versions up to but excluding 3.7.0 of the superagent module are affected by CVE-2017-16129.
How can I fix CVE-2017-16129?
To fix CVE-2017-16129, update the superagent module to version 3.7.0 or higher.
- collector/github-advisory-latest
- alias/GHSA-8225-6cvr-8pqp
- alias/CVE-2017-16129
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/weakness
- agent/author
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/ibm-support
- source/IBM
- agent/remedy
- agent/severity
- agent/references
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- package-manager/npm
- vendor/superagent project
- canonical/superagent project superagent