GHSA-jcw8-r9xm-32c6Critical
Command Injection in dns-sync
🔗 CVE IDs covered (1)
📋 Description
Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve() method.
Recommendation
- Use an alternative dns resolver
- Do not allow untrusted input into
dns-sync.resolve()
🎯 Affected products1
- npm/dns-sync:< 0.1.1
🔗 References (9)
- https://nvd.nist.gov/vuln/detail/CVE-2017-16100
- https://github.com/skoranga/node-dns-sync/issues/1
- https://github.com/skoranga/node-dns-sync/issues/1)
- https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d
- https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d)))
- https://github.com/advisories/GHSA-jcw8-r9xm-32c6
- https://www.npmjs.com/advisories/153
- https://www.npmjs.com/advisories/523
- https://github.com/skoranga/node-dns-sync/issues/5