Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdnNm0tZmhxdi1oZzU2

Denial of Service in yar

Versions of yar prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value.

When an invalid encryped session cookie value is provided, the process will crash.

Recommendation

Update to version 2.2.0 or later.

Permalink: https://github.com/advisories/GHSA-gg6m-fhqv-hg56
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdnNm0tZmhxdi1oZzU2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-gg6m-fhqv-hg56, CVE-2014-4179
References:

• https://github.com/spumko/yar/issues/34
• https://www.npmjs.com/advisories/44
• https://nvd.nist.gov/vuln/detail/CVE-2014-4179
• https://github.com/advisories/GHSA-gg6m-fhqv-hg56

Repository: https://github.com/spumko/yar
Blast Radius: 18.0

Affected Packages