Resource management error in node-querystring - CVE-2014-7191

Vulnerability identifier: #VU88959

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-7191

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to qs module in Node.js does not call the compact function for array data. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

node-querystring
Fedora
nodejs010-nodejs-qs (Red Hat package)
nodejs-qs
nodejs010-node-gyp (Red Hat package)
IBM Security Verify Governance

Install updates from vendor's website.

node-querystring - update to 1.0.0
nodejs010-nodejs-qs (Red Hat package) - addressed in versions 0.6.5-5.el6, 0.6.5-5.el7
nodejs-qs - addressed in versions 0.6.6-3.el6, 0.6.6-3.el7, 0.6.6-3.fc21
nodejs010-node-gyp (Red Hat package) - addressed in versions 3.2.0-3.el6, 3.2.0-3.el7
IBM Security Verify Governance - update to 10.0.2

• http://secunia.com/advisories/60026
• http://secunia.com/advisories/62170
• http://www-01.ibm.com/support/docview.wss?uid=swg21685987
• http://www-01.ibm.com/support/docview.wss?uid=swg21687263
• http://www-01.ibm.com/support/docview.wss?uid=swg21687928
• https://access.redhat.com/errata/RHSA-2016:1380
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96729
• https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8
• https://github.com/visionmedia/node-querystring/issues/104
• https://nodesecurity.io/advisories/qs_dos_memory_exhaustion

• Multiple vulnerabilities in IBM Security Verify Governance
• Fedora 21 update for nodejs-qs
• Fedora EPEL 6 update for nodejs-qs
• Fedora EPEL 7 update for nodejs-qs
• Red Hat Software Collections update for nodejs010-node-gyp and nodejs010-nodejs-qs