All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the second argument to the .powm function, V8 will crash regardless of Node try/catch blocks.
References
| Link | Resource |
|---|---|
| https://github.com/justmoon/node-bignum/blob/ef2e02533e598d6df8421000033c4753cde89ee2/index.js%23L111 | Broken Link Third Party Advisory |
| https://snyk.io/vuln/SNYK-JS-BIGNUM-2388581 | Exploit Third Party Advisory |
| https://github.com/justmoon/node-bignum/blob/ef2e02533e598d6df8421000033c4753cde89ee2/index.js%23L111 | Broken Link Third Party Advisory |
| https://snyk.io/vuln/SNYK-JS-BIGNUM-2388581 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 06:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/justmoon/node-bignum/blob/ef2e02533e598d6df8421000033c4753cde89ee2/index.js%23L111 - Broken Link, Third Party Advisory | |
| References | () https://snyk.io/vuln/SNYK-JS-BIGNUM-2388581 - Exploit, Third Party Advisory |
17 May 2022, 16:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1321 | |
| References | (CONFIRM) https://github.com/justmoon/node-bignum/blob/ef2e02533e598d6df8421000033c4753cde89ee2/index.js%23L111 - Broken Link, Third Party Advisory | |
| References | (CONFIRM) https://snyk.io/vuln/SNYK-JS-BIGNUM-2388581 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CPE | cpe:2.3:a:bignum_project:bignum:*:*:*:*:*:node.js:*:* |
06 May 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-05-06 20:15
Updated : 2024-11-21 06:52
NVD link : CVE-2022-25324
Mitre link : CVE-2022-25324
CVE.ORG link : CVE-2022-25324
JSON object : View
Products Affected
bignum_project
- bignum
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')