Denial of Service in ethereumjs-vm

Description

ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a “code: Buffer.from(my_code, ‘hex’)” attribute.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.4.0

References

• GHSA-2mw7-wggm-m6w3
• CVE-2018-19183
• CWE-119
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in highcharts - highcharts - CVE-2018-20801
• Open Chinese Convert subject to Denial of Service via Out-of-bounds Read - CVE-2018-16982
• Denial of Service in protobufjs - protobufjs - CVE-2018-3738
• Regular Expression Denial of Service (ReDoS) in braces - CVE-2018-1109

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

ethereumjs-vm