Is CVE-2017-20165 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-20165 being exploited in the wild.

How severe is CVE-2017-20165?

Low severity, with a CVSS score of 3.1, published 9 January 2023.

Which products and versions are affected?

debug (npm) SEMVER:introduced=3.0.0,fixed=3.1.0.

Is there a fix for CVE-2017-20165?

Yes. debug (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-20165 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-20165?

Check whether you run debug (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-20165: debug inefficient regular expression complexity

CVE-2017-20165 · Severity: low · CVSS 3.1 · Published 2023-01-09

The debug library is a widely-used Node.js logging utility. A vulnerability in its string-processing function can be exploited to cause a denial-of-service by triggering catastrophic backtracking in a regular expression, causing the application to hang or consume excessive CPU.

Technologies: debug (npm). Vendors: npm.

Quick answers

Is CVE-2017-20165 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-20165 being exploited in the wild.
How severe is CVE-2017-20165?: Low severity, with a CVSS score of 3.1, published 9 January 2023.
Which products and versions are affected?: debug (npm) SEMVER:introduced=3.0.0,fixed=3.1.0.
Is there a fix for CVE-2017-20165?: Yes. debug (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-20165 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-20165?: Check whether you run debug (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

debug (npm): upgrade to 3.1.0 or later
```
npm install debug@3.1.0
```

Technical details

This vulnerability (CWE-1333) involves an inefficient regular expression in the useColors function of src/node.js that is susceptible to Regular Expression Denial of Service (ReDoS) attacks. An attacker can supply a specially-crafted string argument that causes the regex engine to experience catastrophic backtracking, resulting in severe performance degradation or denial of service. The vulnerability affects all versions prior to 2.6.9 and versions 3.0.x (fixed in 3.1.0). No authentication or special privileges are required to trigger the issue; an attacker only needs to control the input passed to the affected function. The fix involves replacing the vulnerable regex pattern with a simpler, more efficient implementation.

Affected products

debug-js debug prior to 2.6.9 and 3.0.x versions (fixed in 3.1.0)

Identifiers

CVE-2017-20165
GHSA-9vvw-cc9w-f27h

Timeline

2023-01-09: disclosed
2017-09-21: patched: Fix merged in PR #504; backported to 2.6.9 and released as 3.1.0

References

https://github.com/debug-js/debug/pull/504

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.