CVE-2018-3737

Aliases:GHSA-2m39-62fm-q8r3
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 07 Jun 2018, 02:00
Last modified:17 Sept 2024, 03:42

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.42% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

07 Jun 2018, 02:00
Published
Vulnerability first disclosed
17 Sept 2024, 03:42
Last Modified
Vulnerability information updated

Description

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.42%• Percentile: 62%

Techniques & Countermeasures

  • CWE-185•Incorrect Regular Expression

    The product specifies a regular expression in a way that causes data to be improperly matched or compared.

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

  • hackerone•sshpk node module

    Versions up to and including 1.13.1

  • joyent•sshpk

    ≤ 1.13.1

  • Npm•sshpk

    < 1.13.2

References (6)