CVE-2018-3737: Regular Expression Denial of Service in sshpk
Summary
CVE-2018-3737: Regular Expression Denial of Service in sshpk. Affects sshpk versions < 1.13.2. Fixed in 1.13.2. How to fix ↓
Also tracked for
- node-sshpk · Debian:11
The same CVE-2018-3737 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sshpk package is an npm package used for parsing and manipulating SSH public and private keys. It provides functionality for generating, validating, and working with SSH keys. The package is widely used in various applications that require SSH key management.
Vulnerability Detail
Versions of sshpk before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service (ReDoS) when parsing crafted invalid public keys. This vulnerability can be exploited by an attacker to cause a denial of service (DoS) by sending specially crafted invalid public keys to the application. The vulnerable code in sshpk fails to properly handle certain regular expressions, leading to excessive backtracking and causing the application to consume excessive CPU resources or crash. The impact of this vulnerability can range from service disruption to complete unavailability.
How To Fix
Minimum fixed version
1.13.2
This is the first release that contains the fix.
npm install sshpk@1.13.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the sshpk package to a patched version to address the issue.
Conclusion
The sshpk package versions before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service (ReDoS). It is crucial to update the package to a patched version to mitigate the risk of a denial of service (DoS) attack. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sshpk →
FAQ
This vulnerability can lead to a denial of service (DoS) condition in applications that use the vulnerable sshpk package. It can result in service disruption or complete unavailability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update the sshpk package to a patched version to mitigate the risk.
No, updating the sshpk package to a patched version is the recommended solution. Manually fixing the vulnerability without updating the package may not address all the underlying issues and could leave the application exposed to potential attacks.
You can find more information about this vulnerability in the GitHub Security Advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-2m39-62fm-q8r3/GHSA-2m39-62fm-q8r3.json
Related vulnerabilities
Recent vulnerabilities recorded for sshpk.
