[GHSA-x5gf-qvw8-r2rm] pm2 Regular Expression Denial of Service vulnerability #6620
Conversation
| }, | ||
| { | ||
| "type": "CVSS_V4", | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" |
There was a problem hiding this comment.
I didn't intend to remove these metrics, but the advisory improvement screen forced me to remove them, and I don't see a way to put them back. I've opened an issue about this limitation in the advisory improvement screen: #5357.
| "CWE-400" | ||
| ], | ||
| "severity": "LOW", | ||
| "severity": "MODERATE", |
There was a problem hiding this comment.
I didn't intend to increase the severity, but the advisory improvement screen forced me to, and I don't see a way to revert this.
github-actions
bot
changed the base branch from
main
to
mhassan1/advisory-improvement-6620
|
As we mentioned in #5804, we do not published advisories without an upper bounds. I can update the upper bound to Also, the description comes from the CVE. Updating it here will not update it for everyone else. If you want to update the CVE description, you need to contact VulDB at cna@vuldb.com. |
The problem I see is that someone on future version 6.0.15 may think they are not vulnerable, even though they are (assuming that version doesn't contain a fix). We will need to keep updating this advisory every time there's an unrelated release. What is the correct way to mark all versions as vulnerable (until there's a patch)? |
advisory-database
bot
merged commit 85c706c
into
mhassan1/advisory-improvement-6620
|
Hi @mhassan1! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
|
Hi @mhassan1, We don't leave the upper bound uncapped so I updated it to |
Updates
Comments
The vulnerable regular expression is present in every version of the library (Unitech/pm2#5971 was reverted in Unitech/pm2@7b022de). This is a follow-up to #5804.