CVE-2022-35142 Raneto Denial of Service via crafted payload injected into `Search` parameter
Attackers can cause a Denial of Service in the Renato library by injecting a crafted payload into the Search parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-35142?
CVE-2022-35142 is a high-severity denial of service vulnerability in n/a, published on 4 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.
Weakness: CWE-287
Which versions are affected by CVE-2022-35142?
2 open source packages ship an affected version, including raneto. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
raneto npm | All versions | 0.17.1 |
raneto npm | All versions | 0.17.1 |
Products include Raneto Project Raneto.
How do I fix CVE-2022-35142?
Upgrade raneto to 0.17.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-35142 being exploited?
There is no known exploitation of CVE-2022-35142 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xxc2-j7jj-6g5m.