Bug 1146054 – CVE-2014-7191 nodejs-qs: Denial-of-Service Memory Exhaustion

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1146054 - (CVE-2014-7191) CVE-2014-7191 nodejs-qs: Denial-of-Service Memory Exhaustion

Summary:	CVE-2014-7191 nodejs-qs: Denial-of-Service Memory Exhaustion

Status:	CLOSED ERRATA

Aliases:	CVE-2014-7191

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140806,repor...
Keywords:	Security

Duplicates:	1146045 (view as bug list)
Depends On:	1146055 1146056 1344158
Blocks:	1146059
	Show dependency tree / graph

Reported:	2014-09-24 07:27 EDT by Vasyl Kaigorodov
Modified:	2016-07-05 02:59 EDT (History)
CC List:	9 users (show)

See Also:
Fixed In Version:	node-querystring 1.0.0
Doc Type:	Bug Fix
Doc Text:	The nodejs-qs module has the ability to create sparse arrays during parsing. By specifying a high index in a querystring parameter it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-07-05 02:59:33 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2016:1380	normal	SHIPPED_LIVE	Moderate: nodejs010-node-gyp and nodejs010-nodejs-qs security and bug fix update	2016-07-05 06:25:12 EDT

Groups: None (edit)

Description Vasyl Kaigorodov 2014-09-24 07:27:36 EDT

The qs module has the ability to create sparse arrays during parsing. By specifying a high index it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.

More information: https://github.com/visionmedia/node-querystring/issues/104
CVE request: http://seclists.org/oss-sec/2014/q3/640

Comment 1 Vasyl Kaigorodov 2014-09-24 07:28:02 EDT

Created nodejs-qs tracking bugs for this issue:

Affects: fedora-all [bug 1146055]
Affects: epel-all [bug 1146056]

Comment 2 T.C. Hollingsworth 2014-09-24 07:32:20 EDT

*** Bug 1146045 has been marked as a duplicate of this bug. ***

Comment 3 Fedora Update System 2014-09-29 00:02:52 EDT

nodejs-qs-0.6.6-3.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Vasyl Kaigorodov 2014-09-30 07:41:55 EDT

CVE-2014-7191 has been assigned with the below comment:

The description seems to suggest that there should be an arbitrary
limit on the index value. That, by itself, might not be considered a
vulnerability report; however, omitting the call to the compact
function can probably be considered a security problem. Use
CVE-2014-7191 for the
https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8
commit.

Comment 5 Fedora Update System 2014-10-06 01:04:20 EDT

nodejs-qs-0.6.6-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2014-10-06 01:04:54 EDT

nodejs-qs-0.6.6-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2014-10-30 21:22:43 EDT

nodejs-qs-0.6.6-3.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2014-10-30 21:24:06 EDT

nodejs-qs-0.6.6-3.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Doran Moppert 2016-06-08 02:54:17 EDT

Statement:

This package is not shipped with any versions of Red Hat Enterprise Linux.  Red Hat Software Collections Library components shipping in version 2.2 are affected.

Comment 16 errata-xmlrpc 2016-07-05 02:25:29 EDT

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS

Via RHSA-2016:1380 https://access.redhat.com/errata/RHSA-2016:1380

Note You need to log in before you can comment on or make changes to this bug.