CVE-2017-16023

Impact:
Moderate
Public Date:
2015-12-23
CWE:
CWE-400
Bugzilla:
1445292: CVE-2017-16023 nodejs-decamelize: Regular expression Denial-of-Service

The MITRE CVE dictionary describes this issue as:

Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a string and takes unescaped separator values, which can be used to create a denial of service attack.

Find out more about CVE-2017-16023 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.

CVSS3 Base Score 7.5
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Impact None
Availability Impact High

Affected Packages State

Platform Package State
Red Hat Software Collections for Red Hat Enterprise Linux rh-nodejs8-nodejs Not affected
Red Hat OpenShift Enterprise 3 nodejs-decamelize Not affected
Red Hat Mobile Application Platform On-Premise 4 fh-mbaas Not affected

Last Modified

CVE description copyright © 2017, The MITRE Corporation

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.