CVE-2018-3737 Regular Expression Denial of Service in sshpk
Attackers can cause denial of service in applications using sshpk by providing crafted invalid public keys that trigger excessive CPU usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-3737?
CVE-2018-3737 is a high-severity denial of service vulnerability in HackerOne sshpk node module, published on 7 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
Which versions are affected by CVE-2018-3737?
2 open source packages ship an affected version, including sshpk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sshpk npm | All versions | 1.13.2 |
sshpk npm | All versions | 1.13.2 |
Products include Joyent Sshpk.
How do I fix CVE-2018-3737?
Upgrade sshpk to 1.13.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-3737 being exploited?
There is no known exploitation of CVE-2018-3737 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-3737, GHSA-2m39-62fm-q8r3, UBUNTU-CVE-2018-3737.