High severity · published Jan 9, 2023
CVE-2017-20165
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x
7.5
CVSS
2.1%
EPSS
No
On KEV
Description
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Debug · Debug Project
before 2.6.9; 3.0.0 before 3.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-20165
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-20165
Patch
https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685
Patch
https://github.com/debug-js/debug/pull/504
Release Notes
https://github.com/debug-js/debug/releases/tag/3.1.0
Third Party Advisory
https://vuldb.com/?ctiid.217665
Third Party Advisory
https://vuldb.com/?id.217665
More from Debug
5.3
CVE-2017-16137
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter