CVE-2014-7191
At a glance
- Source
- NVD
- EPSS
- EPSS 8.31 % · percentile 95 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Weaknesses (CWE)
References
- http://secunia.com/advisories/60026
- http://secunia.com/advisories/62170
- https://github.com/visionmedia/node-querystring/issues/104
- https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8
- https://access.redhat.com/errata/RHSA-2016:1380
- https://nodesecurity.io/advisories/qs_dos_memory_exhaustion
- http://www-01.ibm.com/support/docview.wss?uid=swg21687928
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96729
- http://www-01.ibm.com/support/docview.wss?uid=swg21685987
- http://www-01.ibm.com/support/docview.wss?uid=swg21687263
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-jjv7-qpx3-h62q — Denial-of-Service Memory Exhaustion in qs
European references
- ENISA EUVD · EUVD-2017-0262
- GCVE · GCVE-0-2014-7191
CERT-FR advisories
- CERTFR-2024-AVI-0575 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2014-AVI-509 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*≤ 0.10.18
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |