GHSA-2m39-62fm-q8r3HighCVSS 7.5

Regular Expression Denial of Service in sshpk

Published
August 15, 2018
Last Modified
January 31, 2023

🔗 CVE IDs covered (1)

CVE-2018-3737 →

📋 Description

Versions of sshpk before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.

Recommendation

Update to version 1.13.2, 1.14.1 or later.

🎯 Affected products1

  • npm/sshpk:< 1.13.2

🔗 References (6)