GSD-2014-3742

Vulnerability from gsd - Updated: 2023-12-13 01:22
Details
The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.
Aliases
Aliases
CVE-2014-3742
To clipboard 

{
  "GSD": {
    "alias": "CVE-2014-3742",
    "description": "The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.",
    "id": "GSD-2014-3742"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-3742"
      ],
      "details": "The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors.",
      "id": "GSD-2014-3742",
      "modified": "2023-12-13T01:22:53.659988Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2014-3742",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "[oss-security] 20140514 Re: CVE request: various NodeJS module vulnerabilities",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2014/05/15/2"
          },
          {
            "name": "[oss-security] 20140513 CVE request: various NodeJS module vulnerabilities",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
          },
          {
            "name": "https://github.com/spumko/hapi/issues/1427",
            "refsource": "CONFIRM",
            "url": "https://github.com/spumko/hapi/issues/1427"
          },
          {
            "name": "https://nodesecurity.io/advisories/hapi_File_descriptor_leak_DoS_vulnerability",
            "refsource": "MISC",
            "url": "https://nodesecurity.io/advisories/hapi_File_descriptor_leak_DoS_vulnerability"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "2.0.x || 2.1.x",
          "affected_versions": "Version 2.0.x, version 2.1.x",
          "credit": "Jo Liss",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cwe_ids": [
            "CWE-1035",
            "CWE-399",
            "CWE-937"
          ],
          "date": "2014-05-19",
          "description": "A file descriptor leak that when triggered repeatedly will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.",
          "fixed_versions": [
            "2.2.0"
          ],
          "identifier": "CVE-2014-3742",
          "identifiers": [
            "CVE-2014-3742"
          ],
          "package_slug": "npm/hapi",
          "pubdate": "2014-05-16",
          "solution": "Please upgrade to version 2.2.x or above as soon as possible.",
          "title": "File descriptor leak can cause DoS vulnerability",
          "urls": [],
          "uuid": "1be94237-0b66-4e33-9e6f-a0b40c07373e"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:spumko_project:hapi_server_framework:2.1.2:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:spumko_project:hapi_server_framework:2.1.1:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:spumko_project:hapi_server_framework:2.0.0:-:*:*:*:node.js:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:spumko_project:hapi_server_framework:2.0.0:preview:*:*:*:node.js:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-3742"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor consumption and process crash) via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-399"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/spumko/hapi/issues/1427",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://github.com/spumko/hapi/issues/1427"
            },
            {
              "name": "[oss-security] 20140513 CVE request: various NodeJS module vulnerabilities",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2014/05/13/1"
            },
            {
              "name": "https://nodesecurity.io/advisories/hapi_File_descriptor_leak_DoS_vulnerability",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://nodesecurity.io/advisories/hapi_File_descriptor_leak_DoS_vulnerability"
            },
            {
              "name": "[oss-security] 20140514 Re: CVE request: various NodeJS module vulnerabilities",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2014/05/15/2"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2014-05-19T15:22Z",
      "publishedDate": "2014-05-16T15:55Z"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.