Bug 1146054 (CVE-2014-7191) - CVE-2014-7191 nodejs-qs: Denial-of-Service Memory Exhaustion
Summary: CVE-2014-7191 nodejs-qs: Denial-of-Service Memory Exhaustion
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-7191
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1146045 (view as bug list)
Depends On: 1146055 1146056 1344158
Blocks: 1146059
TreeView+ depends on / blocked
 
Reported: 2014-09-24 11:27 UTC by Vasyl Kaigorodov
Modified: 2021-02-17 06:10 UTC (History)
8 users (show)

Fixed In Version: node-querystring 1.0.0
Doc Type: Bug Fix
Doc Text:
The nodejs-qs module has the ability to create sparse arrays during parsing. By specifying a high index in a querystring parameter it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.
Clone Of:
Environment:
Last Closed: 2016-07-05 06:59:33 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1380 0 normal SHIPPED_LIVE Moderate: nodejs010-node-gyp and nodejs010-nodejs-qs security and bug fix update 2016-07-05 10:25:12 UTC

Description Vasyl Kaigorodov 2014-09-24 11:27:36 UTC 
The qs module has the ability to create sparse arrays during parsing. By specifying a high index it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.

More information: https://github.com/visionmedia/node-querystring/issues/104
CVE request: http://seclists.org/oss-sec/2014/q3/640
Comment 1 Vasyl Kaigorodov 2014-09-24 11:28:02 UTC 
Created nodejs-qs tracking bugs for this issue:

Affects: fedora-all [bug 1146055]
Affects: epel-all [bug 1146056]
Comment 2 T.C. Hollingsworth 2014-09-24 11:32:20 UTC 
*** Bug 1146045 has been marked as a duplicate of this bug. ***
Comment 3 Fedora Update System 2014-09-29 04:02:52 UTC 
nodejs-qs-0.6.6-3.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Vasyl Kaigorodov 2014-09-30 11:41:55 UTC 
CVE-2014-7191 has been assigned with the below comment:

The description seems to suggest that there should be an arbitrary
limit on the index value. That, by itself, might not be considered a
vulnerability report; however, omitting the call to the compact
function can probably be considered a security problem. Use
CVE-2014-7191 for the
https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8
commit.
Comment 5 Fedora Update System 2014-10-06 05:04:20 UTC 
nodejs-qs-0.6.6-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2014-10-06 05:04:54 UTC 
nodejs-qs-0.6.6-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2014-10-31 01:22:43 UTC 
nodejs-qs-0.6.6-3.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2014-10-31 01:24:06 UTC 
nodejs-qs-0.6.6-3.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Doran Moppert 2016-06-08 06:54:17 UTC 
Statement:

This package is not shipped with any versions of Red Hat Enterprise Linux.  Red Hat Software Collections Library components shipping in version 2.2 are affected.
Comment 16 errata-xmlrpc 2016-07-05 06:25:29 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS

Via RHSA-2016:1380 https://access.redhat.com/errata/RHSA-2016:1380
Note You need to log in before you can comment on or make changes to this bug.