CVE-2017-20162: vercel ms index.js parse redos
First published: Thu Jan 05 2023(Updated: )
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
Credit: cna@vuldb.com cna@vuldb.com cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/ms | <2.0.0 | 2.0.0 |
| Vercel Ms | <2.0.0 | |
| IBM Cognos Analytics | <=12.0.0-12.0.2 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-20162
- https://github.com/vercel/ms/pull/89
- https://github.com/vercel/ms/commit/caae2988ba2a37765d055c4eee63d383320ee662
- https://github.com/vercel/ms/releases/tag/2.0.0
- https://vuldb.com/?ctiid.217451
- https://vuldb.com/?id.217451
- https://github.com/advisories/GHSA-w9mr-4mfr-499f (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/244072
- https://www.ibm.com/support/pages/node/7156941 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2017-20162?
The severity of CVE-2017-20162 is medium with a CVSS score of 5.3.
What is the affected software for CVE-2017-20162?
The affected software for CVE-2017-20162 is vercel ms up to version 1.x and node.js up to version 2.0.0.
How can the vulnerability in CVE-2017-20162 be exploited?
The vulnerability in CVE-2017-20162 can be exploited remotely by manipulating the argument 'str' to cause inefficient regular expression complexity.
What is the remedy for CVE-2017-20162?
The remedy for CVE-2017-20162 is to upgrade to version 2.0.0 of vercel ms.
Where can I find more information about CVE-2017-20162?
More information about CVE-2017-20162 can be found at the following references: [1](https://nvd.nist.gov/vuln/detail/CVE-2017-20162), [2](https://github.com/vercel/ms/pull/89), [3](https://github.com/vercel/ms/commit/caae2988ba2a37765d055c4eee63d383320ee662).
- collector/github-advisory-latest
- alias/GHSA-w9mr-4mfr-499f
- alias/CVE-2017-20162
- collector/nvd-index
- collector/github-advisory
- collector/nvd-cve
- agent/type
- agent/remedy
- agent/weakness
- agent/author
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/ibm-support
- source/IBM
- agent/references
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/tags
- agent/event
- agent/first-publish-date
- package-manager/npm
- vendor/vercel
- canonical/vercel ms
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.2
- version/ibm cognos analytics/11.2.0-11.2.4 fp3