Quick answers
- Is CVE-2015-8855 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2015-8855 being exploited in the wild.
- How severe is CVE-2015-8855?
- High severity, with a CVSS score of 7.5, published 23 January 2017.
- Which products and versions are affected?
- Node.js Semver < 4.3.2; Semver SEMVER:introduced=1.0.4,fixed=4.3.2.
- Is there a fix for CVE-2015-8855?
- Yes. Semver: upgrade to 4.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2015-8855 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2015-8855?
- Check whether you run Node.js Semver, Nodejs Node.Js or Semver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Semver: upgrade to 4.3.2 or later
Technical details
The semver package prior to version 4.3.2 contains a Regular Expression Denial of Service (ReDoS) vulnerability. The issue resides in the regular expressions used to parse and validate version strings; when processed against specifically crafted, excessively long input strings, the regex engine experiences catastrophic backtracking. This results in 100% CPU utilization for the affected Node.js event loop thread. The attack can be launched remotely without authentication if the application accepts user-supplied version strings for comparison or validation. The vulnerability is resolved in version 4.3.2.
Affected products
- Node.js semver < 4.3.2
Identifiers
- CVE-2015-8855
- GHSA-x6fg-f45m-jf5q
Timeline
- 2015-08-03: disclosed: Internal disclosure via Node Security Project (approximate based on CVE year)
- 2017-01-23: advisory: NVD publication date