Is CVE-2014-3742 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2014-3742 being exploited in the wild.

How severe is CVE-2014-3742?

Informational severity, published 24 October 2017.

Which products and versions are affected?

hapi (npm) SEMVER:introduced=2.0.0,fixed=2.2.0.

Is there a fix for CVE-2014-3742?

Yes. hapi (npm): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2014-3742 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2014-3742?

Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2014-3742: hapi file descriptor leak denial of service

CVE-2014-3742 · Severity: info · Published 2017-10-24

hapi is a widely-used web framework for Node.js applications. Versions 2.0.x and 2.1.x contain a file descriptor leak that allows an attacker to repeatedly trigger the leak, eventually exhausting the server's available file descriptors and causing the Node.js process to crash. This results in denial of service and unavailability of the application.

Technologies: hapi (npm). Vendors: npm.

Quick answers

Is CVE-2014-3742 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2014-3742 being exploited in the wild.
How severe is CVE-2014-3742?: Informational severity, published 24 October 2017.
Which products and versions are affected?: hapi (npm) SEMVER:introduced=2.0.0,fixed=2.2.0.
Is there a fix for CVE-2014-3742?: Yes. hapi (npm): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2014-3742 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2014-3742?: Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hapi (npm): upgrade to 2.2.0 or later
```
npm install hapi@2.2.0
```

Technical details

The vulnerability is a resource exhaustion issue (CWE-400) in hapi versions 2.0.x and 2.1.x where improper file descriptor management leads to a leak. An attacker can trigger this leak repeatedly via network requests to exhaust the process file descriptor limit, causing the server to become unresponsive and eventually terminate. The vulnerability requires only network access with no authentication. The fix is available in version 2.2.0 and later.

Affected products

hapi hapi 2.0.x, 2.1.x

Identifiers

CVE-2014-3742
GHSA-cqr7-78pj-3g7j

Timeline

2014-05: disclosed: Vulnerability disclosed to oss-security mailing list
2014: patched: Fixed in hapi version 2.2.0
2017-10-24: advisory: GHSA advisory published

References

https://github.com/spumko/hapi/issues/1427

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.