CVE-2024-55565
Description
A flaw was found in nanoid. Affected versions of nanoid mishandles non-integer values. When nanoid is called with a fractional value, there were a number of undesirable effects:
- In browser and non-secure, the code infinite loops on while (size--)
- In node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled: when i is initialized to poolOffset, pool[i] & 63 -> undefined & 63 -> 0
- If the first call in node is a fractional argument, the initial buffer allocation fails with an error
The highest impact of this issue system availability.
Statement
Moderate impact: CVE-2024-55565 affects Red Hat products and components that ship nanoid in the current affected mappings. When nanoid is called with a fractional size, browser and non-secure implementations can enter an infinite loop; in Node.js, calls can return zeroes until the pool is refilled, and an initial fractional call can fail buffer allocation. These behaviors can impair system availability. Red Hat rates the issue Moderate (CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The current scope spans Red Hat middleware, Ansible, OpenShift, cloud services, Enterprise Linux, and Ceph mappings, as well as Community Projects: 196 of 198 mappings are marked AFFECTED and two are NEW/OOSS. Delegated handling includes affected, WONTFIX, OOSS, DEFER, and NOTAFFECTED outcomes. For delegated mappings marked AFFECTED, a fix is being pursued. For DEFER mappings, the record does not state why remediation is deferred; the residual risk is continued availability or functional impact if fractional values reach nanoid. Mappings delegated as NOTAFFECTED are product-specific determinations, but the record provides no technical rationale for them. The Red Hat assessment is higher than the external CISA score (6.5 versus 4.3), reflecting different assumptions about required privileges and affected security properties.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 4.3 |
| Attack Vector | Adjacent Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | Low |
| Availability Impact | High | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
