Denial of Service Vulnerability in Node-Semver Package: CVE-2015-8855
Summary
UBUNTU-CVE-2015-8855: The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS).". Affects node-semver versions < 2.1.0-2ubuntu0.0.1~esm1. Fixed in 2.1.0-2ubuntu0.0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Node-Semver package is a widely used library in Node.js applications that provides utilities for semantic versioning. It allows developers to parse, compare, and manipulate version numbers according to the semantic versioning specification. This package is crucial for managing dependencies and ensuring compatibility between different software components. However, it has been found to be vulnerable to a denial of service attack due to its handling of long version strings, which can lead to excessive CPU consumption.
Vulnerability Detail
The vulnerability, identified as CVE-2015-8855, affects versions of the semver package prior to 4.3.2. It allows attackers to exploit the package by providing a long version string, which triggers a regular expression denial of service (ReDoS) attack. This can result in significant CPU consumption, potentially leading to application downtime or degraded performance. The vulnerability stems from inefficient regular expression patterns used in the package, making it susceptible to crafted input that can cause excessive backtracking.
How To Fix
Minimum fixed version
2.1.0-2ubuntu0.0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-semverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to restrict the length of version strings processed by the semver package. This can help mitigate the risk of denial of service attacks while a permanent fix is being applied.
Conclusion
CVE-2015-8855 is a significant vulnerability in the Node-Semver package that can lead to denial of service attacks. It is crucial for developers to update to the patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-semver →
FAQ
CVE-2015-8855 is a vulnerability in the Node-Semver package that allows for denial of service attacks through long version strings.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to excessive CPU consumption, causing application slowdowns or crashes, which can impact user experience and service availability.
Yes, patched versions of the Node-Semver package are available for Ubuntu 14.04 and 16.04 LTS.
Implement input validation to restrict the length of version strings as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for node-semver.
