CVE-2021-39171

CVE-2021-39171 · Unlimited transforms allowed for signed nodes

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.

CVSS 5.3 · Media · EPSS 1,3% · Corrección disponible

Publicación

2021-08-27T22:05:11.000Z

Actualización

2024-08-04T01:58:18.150Z

Pila tecnológica: node

Comprueba tu servidor →