CVE-2019-17592: High severity Csv-parse Project Csv-parse Node.js vulnerability

Q: What configuration is required for exploitation?

The vulnerable regular expression is reached when csv-parse is used with the cast option enabled. The issue affects versions before 4.4.6.

Q: What would an attacker need to do?

An attacker would need to supply a large, crafted CSV input that is processed by the affected parser with the cast option enabled. No privileges or user interaction are indicated by the provided vector.

Q: What is the impact of successful exploitation?

Processing the crafted input can be very slow, resulting in a regular expression denial of service. The provided severity vector indicates availability impact, with no stated confidentiality or integrity impact.

Q: What should teams do if they use this package?

Apply the available patch by updating csv-parse to version 4.4.6 or later. Prioritize deployments that parse attacker-controlled or otherwise untrusted CSV data with the cast option enabled.

Published Oct 14, 2019

Updated

The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.

Affected Software

2 affected components

Csv-parse Project Csv-parse Node.js<4.4.6

Fedoraproject Fedora=31

Remediation

Patch Available

https://github.com/adaltas/node-csv-parse/commit/b9d35940c6815cdf1dfd6b21857a1f6d0fd51e4a

Event History

Oct 14, 2019

CVE Published

via MITRE·07:59 PM

Data Sourced

via MITRE·07:59 PM

Description

Data Sourced

via OSV·08:15 PM

DescriptionSeverity

Frequently Asked Questions

What configuration is required for exploitation?

The vulnerable regular expression is reached when csv-parse is used with the cast option enabled. The issue affects versions before 4.4.6.

What would an attacker need to do?

An attacker would need to supply a large, crafted CSV input that is processed by the affected parser with the cast option enabled. No privileges or user interaction are indicated by the provided vector.

What is the impact of successful exploitation?

Processing the crafted input can be very slow, resulting in a regular expression denial of service. The provided severity vector indicates availability impact, with no stated confidentiality or integrity impact.

What should teams do if they use this package?

Apply the available patch by updating csv-parse to version 4.4.6 or later. Prioritize deployments that parse attacker-controlled or otherwise untrusted CSV data with the cast option enabled.

CVE-2019-17592: High severity Csv-parse Project Csv-parse Node.js vulnerability

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

What configuration is required for exploitation?

What would an attacker need to do?

What is the impact of successful exploitation?

What should teams do if they use this package?

Company

Resources

Contact

Frequently Asked Questions

What configuration is required for exploitation?

What would an attacker need to do?

What is the impact of successful exploitation?

What should teams do if they use this package?