Bug 1623744

Summary:	nodejs-mem: Memory leak due to old results remaining in cache after reaching maxAge allows for DoS
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	cbyrne, cmacedo, dffrench, drusso, hhorak, jmadigan, jorton, jshepherd, lgriffin, ngough, pwright, trepel, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-mem 4.0.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:37:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1623747

Description Sam Fowler 2018-08-30 05:46:15 UTC

nodejs-mem before version 4.0.0 has a memory leak due to old results not being removed from the cache despite reaching maxAge. Exploitation of this can lead to exhaustion of memory and subsequent denial of service.


Upstream Issue:

https://github.com/sindresorhus/mem/issues/14


Upstream Patch:

https://github.com/sindresorhus/mem/commit/da4e4398cb27b602de3bd55f746efa9b4a31702b

Comment 1 Tomas Hoger 2018-09-26 20:28:10 UTC

Snyk advisory:

https://snyk.io/vuln/npm:mem:20180117

Comment 2 Tomas Hoger 2018-09-26 20:39:50 UTC

The mem package is used by / bundled with npm (via libnpx -> yargs -> os-locale -> mem).  The os-locale package does not specify maxAge in its uses of maxAge, keeping the the cached values in memory forever.  Hence this bug is not relevant to the use of mem in npm.