Description
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| debug-js | debug | 3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-debug | 3.1.0-1 | — |
| Debian 13 | node-debug | 3.1.0-1 | — |
| Debian 12 | node-debug | 3.1.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-debug | No fix yet | — |
| Ubuntu 16.04 LTS | node-debug | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
fastify/send ★ 16 · Jan 11, 2023
Fork of the send module to deal with CVE-2017-20165
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | debug | >= 3.0.0, < 3.1.0 | 3.1.0 | GHSA-9vvw-cc9w-f27h |
| npm | debug | < 2.6.9 | 2.6.9 | GHSA-9vvw-cc9w-f27h |
References
- https://vuldb.com/?id.217665 vdb-entry technical-description
- https://vuldb.com/?ctiid.217665 signature permissions-required
- https://github.com/debug-js/debug/pull/504 issue-tracking
- https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685 patch
- https://github.com/debug-js/debug/releases/tag/3.1.0 patch