CVE-2022-21211 Denial of Service (DoS)
An attacker can cause a denial of service in applications using the posix library by triggering a crash via the toString method.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-21211?
CVE-2022-21211 is a medium-severity denial of service vulnerability in posix, published on 10 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a function), and then it will crash with type-check.
Weakness: CWE-252
Which versions are affected by CVE-2022-21211?
2 open source packages ship an affected version, including posix. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
posix npm | All versions to 4.2.0 | None |
posix npm | All versions to 4.2.0 | None |
Products include Posix Project Posix.
How do I fix CVE-2022-21211?
No fix has been published for CVE-2022-21211 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-21211 being exploited?
There is no known exploitation of CVE-2022-21211 in the wild and no public exploit code.
Sources
Also known as GHSA-27mx-gchc-6xjp.