CVE-2022-36127
HIGH7.5EPSS 5.2%Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header
發布日:2022/7/19修改日:2023/11/8
描述
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
受影響套件(1)
- npm/skywalking-backend-jsfrom 0, < 0.5.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
參考連結(5)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-36127
- PATCHhttps://github.com/apache/skywalking-nodejs
- WEBhttps://lists.apache.org/thread/x238wo4r5goy39dxdjcmlofp6gcdnqr3
- WEBhttps://skywalking.apache.org/events/release-apache-skywalking-nodejs-0-5-1
- WEBhttp://www.openwall.com/lists/oss-security/2022/07/18/1